Global Genes has adopted this Privacy Policy to explain how we use the personal data that we collect from you when you use our website.
Whose personal data do we collect?
For the below groups or individuals, we process and retain personal data for the following purposes and periods, with the applicable legal basis.
Medical Student
Processing purpose
Legal basis
Retention period
To pair students with an individual / family living with a rare disease and to learn firsthand about the
experiences of patients and families living with rare diseases to help you build compassion, understanding,
and empathetic communication skills to help you gain interest in specializing in fields most relevant to rare
disease to maintain your data for future communication and engagement if you agree to the media release
(provided on the following page), your name could be used in promotion of the program
6(1)(a) – we have the data subject’s consent
Until consent withdrawn
Media
Processing purpose
Legal basis
Retention period
To register for event. To receive outbound marketing communications. To recruit potential speakers for event
or future event. To measure inclusivity of the program/event.
6(1)(a) – we have the data subject’s consent
Until consent withdrawn
Global Advocacy Alliance Member
Processing purpose
Legal basis
Retention period
To apply for grant and for further communication about the grant program
6(1)(f) – it’s the legitimate interest of a third party
Until consent withdrawn
Industry Worker
Processing purpose
Legal basis
Retention period
To deliver content best matched to the industry worker’s expressed interest. To incorporate industry worker
in our mailing list. To facilitate connections among participants. To customize advertising messages to the
interest of the industry worker .
6(1)(a) – we have the data subject’s consent
Until consent withdrawn
To register for event. To receive outbound marketing communications. To recruit potential speakers for event
or future event. To measure inclusivity of the program/event.
6(1)(a) – we have the data subject’s consent
Until consent withdrawn
Patients
Processing purpose
Legal basis
Retention period
Communications, marketing and intelligence
6(1)(a) – we have the data subject’s consent
Until consent withdrawn
To pair an individual with a medical student to help educate them about the unique needs and challenges
presented by living with a rare disease to help medical students understand how they can better advocate for
and recognize patients living with a complex rare condition to gain a greater understanding of the medical
system, foster mutual understanding and compassion, increase the impact of your lived experience, and prepare
you to better communicate with your doctors and other medical professionals to maintain your data for future
communication and engagement if you agree to the media release, your name could be used in promotion of the
program
6(1)(a) – we have the data subject’s consent
Until consent withdrawn
To deliver content best matched to the patient’s expressed interest. To incorporate patient in our mailing
list. To facilitate connections among participants. To customize advertising messages to the interest of the
patient .
6(1)(a) – we have the data subject’s consent
Until consent withdrawn
To respond to questions from the data subject. To send periodic mailings of interest to the data subject.
6(1)(a) – we have the data subject’s consent
Until consent withdrawn
To register for event. To receive outbound marketing communications. To recruit potential speakers for event
or future event. To measure inclusivity of the program/event.
6(1)(a) – we have the data subject’s consent
Until consent withdrawn
To apply for grant and for further communication about the grant program
6(1)(f) – it’s the legitimate interest of a third party
Until consent withdrawn
To review and verify application. To maintain data for future communication and engagement
6(1)(a) – we have the data subject’s consent
Until consent withdrawn
Participants
Processing purpose
Legal basis
Retention period
to provide Services related to our mission to accelerate diagnosis, disease understanding, and development
of future treatments and cures across rare diseases
6(1)(a) – we have the data subject’s consent
Until consent withdrawn
Care Giver
Processing purpose
Legal basis
Retention period
To deliver content best matched to the caregiver’s expressed interest. To incorporate caregiver in our
mailing list. To facilitate connections among participants. To customize advertising messages to the interest
of the caregiver.
6(1)(a) – we have the data subject’s consent
Until consent withdrawn
To register for event. To receive outbound marketing communications. To recruit potential speakers for event
or future event. To measure inclusivity of the program/event.
6(1)(a) – we have the data subject’s consent
Until consent withdrawn
To apply for grant and for further communication about the grant program
6(1)(f) – it’s the legitimate interest of a third party
Until consent withdrawn
To review and verify application. To maintain data for future communication and engagement
6(1)(a) – we have the data subject’s consent
Until consent withdrawn
Care Giver
Processing purpose
Legal basis
Retention period
To deliver content best matched to the caregiver’s expressed interest. To incorporate caregiver in our
mailing list. To facilitate connections among participants. To customize advertising messages to the interest
of the caregiver.
6(1)(a) – we have the data subject’s consent
Until consent withdrawn
To register for event. To receive outbound marketing communications. To recruit potential speakers for event
or future event. To measure inclusivity of the program/event.
6(1)(a) – we have the data subject’s consent
Until consent withdrawn
To apply for grant and for further communication about the grant program
6(1)(f) – it’s the legitimate interest of a third party
Until consent withdrawn
To review and verify application. To maintain data for future communication and engagement
6(1)(a) – we have the data subject’s consent
Until consent withdrawn
Patient Advocate
Processing purpose
Legal basis
Retention period
To deliver content best matched to the patient advocate’s expressed interest. To incorporate patient
advocate in our mailing list. To facilitate connections among participants. To customize advertising messages
to the interest of the patient advocate.
6(1)(a) – we have the data subject’s consent
Until consent withdrawn
To register for event. To receive outbound marketing communications. To recruit potential speakers for event
or future event. To measure inclusivity of the program/event.
6(1)(a) – we have the data subject’s consent
Until consent withdrawn
To apply for grant and for further communication about the grant program
6(1)(f) – it’s the legitimate interest of a third party
Until consent withdrawn
To review and verify application. To maintain data for future communication and engagement
6(1)(a) – we have the data subject’s consent
Until consent withdrawn
To review and verify poster submission. To maintain data for future communication and engagement.
6(1)(a) – we have the data subject’s consent
Until consent withdrawn
Scientist
Processing purpose
Legal basis
Retention period
To deliver content best matched to the scientist’s expressed interest. To incorporate scientist in our
mailing list. To facilitate connections among participants. To customize advertising messages to the interest
of the scientist.
6(1)(a) – we have the data subject’s consent
Until consent withdrawn
To register for event. To receive outbound marketing communications. To recruit potential speakers for event
or future event. To measure inclusivity of the program/event.
6(1)(a) – we have the data subject’s consent
Until consent withdrawn
To review and verify poster submission. To maintain data for future communication and engagement.
6(1)(a) – we have the data subject’s consent
Until consent withdrawn
Researchers
Processing purpose
Legal basis
Retention period
To deliver content best matched to the researcher’s expressed interest. To incorporate researcher in our
mailing list. To facilitate connections among participants. To customize advertising messages to the interest
of the researcher.
6(1)(a) – we have the data subject’s consent
Until consent withdrawn
To register for event. To receive outbound marketing communications. To recruit potential speakers for event
or future event. To measure inclusivity of the program/event.
6(1)(a) – we have the data subject’s consent
Until consent withdrawn
To review and verify poster submission. To maintain data for future communication and engagement.
6(1)(a) – we have the data subject’s consent
Until consent withdrawn
Healthcare Professionals
Processing purpose
Legal basis
Retention period
To deliver content best matched to the healthcare professional’s expressed interest. To incorporate
healthcare professional in our mailing list. To facilitate connections among participants. To customize
advertising messages to the interest of the healthcare professional.
6(1)(a) – we have the data subject’s consent
Until consent withdrawn
To register for event. To receive outbound marketing communications. To recruit potential speakers for event
or future event. To measure inclusivity of the program/event.
6(1)(a) – we have the data subject’s consent
Until consent withdrawn
Academic
Processing purpose
Legal basis
Retention period
Communications, marketing and intelligence
6(1)(f) – it’s in our legitimate interest (Communications, marketing and intelligence)
Until consent withdrawn
To deliver content best matched to the academic’s expressed interest. To incorporate academic in our mailing
list. To facilitate connections among participants. To customize advertising messages to the interest of the
academic.
6(1)(a) – we have the data subject’s consent
Until consent withdrawn
To register for event. To receive outbound marketing communications. To recruit potential speakers for event
or future event. To measure inclusivity of the program/event.
6(1)(a) – we have the data subject’s consent
Until consent withdrawn
What personal data do we collect?
Depending on your choice of Global Genes program that you participate in, we may collect the following personal data:
Age
Birthdate
Ethnicity
Gender
Disease of Interest
Diagnosed
Diagnosis
Preferred Language
Medical Specialist
Country
Marital Status
Type of Insurance
Symptoms
City
State
Organization and Title
title
Pronouns
Employment History
Family
Financial Details
Name
Photographs together with Identifiers
Telephone contact details
Visual Images
Digital Images
Education History
Email, Social Networks
professional designation
Race
Medical School
Medical Specialty
We collect special category personal data and do so under the following legal basis:
Genetic data
9(2)(e) – Personal data has already been made public by the data subject
Health
9(2)(a) – Explicit consent of the data subject
9(2)(e) – Personal data has already been made public by the data subject
Racial or Ethnic Origin
9(2)(a) – Explicit consent of the data subject
Sex life or Sexual orientation
9(2)(a) – Explicit consent of the data subject
How do we collect your personal data?
If you visit our website, your browser transmits some data automatically, such as the date and time of retrieval of one of our webpages, your browser type and settings, your operating system, the last webpage you visited, the data transmitted and the access status, and your IP address.
If you use our services, we collect your personal data upon your registration.
We also may receive your data indirectly from the following sources:
Data Subject Type
Personal Data Type
Indirect Source
Patients
Age
CRM SaaS Application
Patients
Birthdate
CRM SaaS Application
Patients
Ethnicity
CRM SaaS Application
Patients
Gender
CRM SaaS Application
Patients
Disease of Interest
CRM SaaS Application
Patients
Diagnosis
CRM SaaS Application
Patients
Location Information
CRM SaaS Application
Patients
Name
CRM SaaS Application
Patients
Telephone contact details
CRM SaaS Application
Patients
Email, Social Networks
CRM SaaS Application
How may we may share your data?
Data subject type
Organization name
Type
Country
Patients
Gmass
Processor
United States
Patients
Google Cloud – Iowa (us-central1)
Processor
United States
Patients
Medical Students
Controller
United States
Patients
Salesforce, Inc.
Processor
United States
Participants
Across Healthcare
Processor
United States
Participants
Google Cloud – Iowa (us-central1)
Processor
United States
Participants
Patient Advocacy Groups
Controller
United States
Participants
Research Institutions and Projects
Controller
United States
Participants
Salesforce, Inc.
Processor
United States
Participants
The Broad institute
Processor
United States
How do we store your data?
We securely store your data in the Google Cloud. We are continuously improving our Information Security Management System and implement administrative and technical safeguards based on a risk based approach.
Joint controllers and data processors
We act as a data controller with respect to your personal data.
Some of your data is shared with our joint controllers and data processors that are located outside of the European Economic Area (EEA) and UK. If we transfer your personal data outside of the EEA and UK, we will require the recipient to protect it in accordance with the standards set forth in the GDPR and UK GDPR. Our protection measures include technical safeguards and use of the EU Standard Data Protection Clauses with the UK addendum.
We may share your personal data with joint controllers if you wish to connect with a rare disease advocacy group (Patient Advocacy Group) or if you are a participant or non-participant in the RARE-X Data Collection Program that we operate, depending on what you agree to in the informed consent forms, that include:
Institutions that perform approved research
IRB approved research projects
Depending on what you agree to at the time of collection and in the informed consent forms, data processors (service providers) may process your personal data on our behalf. Our service providers include:
Across Healthcare
The Broad Institute, Inc.
Google
Salesforce
HappyFox
HubSpot
GMass
Zoom
Higher Logic
Form Assembly
Amazon
Cvent
What are your data protection rights?
We want to make sure that you are fully aware of all of your data protection rights. These are as follows:
Right to access – You have the right to ask us for copies of your personal data. We may charge a small fee for this service.
Right to rectification – You have the right to request that we correct any information that you believe is inaccurate. You also have the right to ask us to complete information that you believe is incomplete.
Right to erasure – You have the right request that we erase your personal data under certain conditions.
Right to restrict processing – You have the right to request that we restrict the processing of your personal data under certain conditions.
Right to object to processing – You have the right to object to our processing of your personal data under certain conditions.
Right to data portability – You have the right to request that we transfer the data that we have collected to another organization, or directly to you, under certain conditions.
Right regarding automatic data processing – You have the right not to be subject to a decision based solely on automatic data processing. We do not perform any automated decision making using your personal data.
If you ask to exercise a right, we have one month to respond to you. You can exercise a right by completing the online form at https://globalgenes.org/privacy-request or calling us at +1 (716) 427-2739 or emailing us at [email protected].
If you are a participant in the RARE-X Data Collection Program, please see our RARE-X Data Collection Program Privacy Policy to learn more about managing your rights, including limiting the sharing of your personal data and deleting your account for that program.
Withdrawal of Consent
You may withdraw any consent that you have given regarding your personal data at any time, recognizing that the withdrawal will not affect the lawfulness of processing that already has been done on the basis of that consent.
What are cookies?
Cookies are text files placed on your computer to collect standard Internet log information and visitor behavior information. When you visit our website, we may collect information from you automatically through cookies or similar technology.
How do we use cookies?
We use cookies in the range of ways to improve your experience under the website, including:
Keeping you signed in
Understanding how you use our website so that we can improve your experience with it
Tailoring features, content, and services to your needs
Improving our understanding of user interaction with our services
We may access information about use of our website or services in order to create aggregate usage data for both internal use and in some cases public dissemination. The data collected will not contain any specific personal information about you or any other website users.
What types of cookies do we use?
We use cookies to assist us in recognizing you on our website and remembering your previously selected preferences. These could include what language you prefer and where you are located.
We use “session” cookies, which are cookies that expire at the end of a browser session (normally when the user exits their browser).
We also use “persistent” cookies, which we retain after the browser session ends and which we store for a longer period of time.
You can set your browser not to accept cookies, and our website tells you how to remove cookies from your browser. However, in a few cases, some of our website features may not function as a result.
Our privacy policy applies only to our website and other iteractions with us. If you click on a link to another website, read their privacy policy.
We keep our privacy policy under regular review in place any updates on this web site. This privacy policy was last updated on February 18, 2023
Please do not hesitate to contact us if you have any questions about our privacy policy or the data we hold on you, or if you would like to exercise any of your data protection rights. You may contact us through our Data Protection Officer as follows:
If you wish to lodge a complaint or if you feel that we have not addressed your concerns in a satisfactory manner, you may contact our Supervisory Authority as follows.
If you are in the EU/EEA or UK, you may also reach us through DataRep, Global Genes’ EU/UK Data Protection Representative. Information about how to do so can be found at https://globalgenes.org/data-representative.
How to manage your cookies
You can set your browser not to accept cookies, and our website tells you how to remove cookies from your browser. However, in a few cases, some of our website features may not function as a result.
Privacy policies of other websites
Our privacy policy applies only to our website and other interactions with us. If you click on a link to another website, read their privacy policy.
Changes to our privacy policy
We keep our privacy policy under regular review in place any updates on this web site. This privacy policy was last updated on February 18, 2023
How to contact us
Please do not hesitate to contact us if you have any questions about our privacy policy or the data we hold on you, or if you would like to exercise any of your data protection rights. You may contact us through our Data Protection Officer as follows:
If you wish to lodge a complaint or if you feel that we have not addressed your concerns in a satisfactory manner, you may contact our Supervisory Authority as follows.
If you are in the EU/EEA or UK, you may also reach us through DataRep, Global Genes’ EU/UK Data Protection Representative. Information about how to do so can be found at https://globalgenes.org/data-representative.
