Global Genes – Privacy Notice

Last updated: August 14, 2026

This Privacy Notice provides details of the personal data we collect from you, what we do with it, how you might access it and who it might be shared with.

Our Contact Information (Data Controller)

What we do with your personal data

We process personal data only for the purpose for which they are collected. The purpose is dependent on whether you use only our website, or additionally, our services. If you use our services you are required to register and we collect your personal data. We use this personal data for the provision of the service or the performance of the contract. We may use your personal data for other similar purposes, including marketing and communications, but that will only occur in the case we have your consent or another legal justification for doing so.

Without prejudice to the retention periods indicated herein, we may store your personal data for a longer or shorter period of time, in cases where such retention is necessary to comply with a specific legal obligation or to defend rights and interests in judicial or administrative proceedings, or if the data subject exercises, within the legal limits, his or her rights to object, erase or withdraw consent.

From our RARE Concierge Participants we process and retain personal data for the following purposes and periods, with the applicable legal basis.

From our Global Advocacy Alliance Participants we process and retain personal data for the following purposes and periods, with the applicable legal basis.

From our RARE Drug Development Symposium Participants we process and retain personal data for the following purposes and periods, with the applicable legal basis.

From our Corporate Alliance Representatives we process and retain personal data for the following purposes and periods, with the applicable legal basis.

From our RARE X Data Collection Program Participants we process and retain personal data for the following purposes and periods, with the applicable legal basis.

From our Stay Connected Participants we process and retain personal data for the following purposes and periods, with the applicable legal basis.

From our Survey Participants we process and retain personal data for the following purposes and periods, with the applicable legal basis.

From our RARE-X PAG Representative we process and retain personal data for the following purposes and periods, with the applicable legal basis.

From our Event Organizer we process and retain personal data for the following purposes and periods, with the applicable legal basis.

From our Share Your Story Participants we process and retain personal data for the following purposes and periods, with the applicable legal basis.

From our Donor we process and retain personal data for the following purposes and periods, with the applicable legal basis.

From our Researcher we process and retain personal data for the following purposes and periods, with the applicable legal basis.

From our Previous Event or Program Participant we process and retain personal data for the following purposes and periods, with the applicable legal basis.

What personal data do we collect?

The personal data we collect depends on whether you just visit our website or use our services. If you visit our website, you do not need to provide us with any personal data. However, your browser transmits some data automatically, such as the date and time of retrieval of one of our web pages, your browser type and settings, your operating system, the last web page you visited, the data transmitted and the access status, and your IP address.

If you use our services, personal data is required to fulfill the requirements of a contractual or service relationship, which may exist between you and our organisation.

We collect:

• Racial or Ethnic Origin
• Gender
• Contact Information
• Video recordings
• Age
• Birthdate
• Disease of Interest
• Preferred Language
• Country
• Marital Status
• Type of Insurance
• Symptoms
• City
• Organization and Title
• Title
• Organization
• Professional designation
• Role in Rare
• Financial Details
• Identification Number
• Location Information
• Name
• Telephone contact details
• Visual Images
• Digital Images
• Email, Social Networks

We collect special category personal data and do so under the following legal basis:

• Diagnosis
  • 9(2)(a) – Explicit consent of the data subject
• Medical Report
  • 9(2)(a) – Explicit consent of the data subject
• Ethnicity
  • 9(2)(a) – Explicit consent of the data subject
• Genetic data
  • 9(2)(a) – Explicit consent of the data subject
• Health
  • 9(2)(a) – Explicit consent of the data subject
• Sex life or Sexual orientation
  • 9(2)(a) – Explicit consent of the data subject

We collect your personal data from the following indirect sources

Who might we share your personal data with?

To maintain and improve our services, your personal data may need to be shared with or disclosed to service providers, other Controllers or, in some cases, public authorities. We may be mandated to disclose your personal data in response to requests from a court, police services or other regulatory bodies. Where feasible, we will consult with you prior to making such disclosure and, in order to protect your privacy, we will ensure that we will disclose only the minimum amount of your information necessary for the required purpose.

We transfer personal data to the following organisations and countries:

When a Processor or Controller is in a country outside the EU, we apply the necessary safeguards which may include, confirming whether the EC approves of transfers to the country, whether we need to use the EC’s model contracts or, if the transfer is internal to our organisation, commitment to Binding Corporate Rules. Details of these safeguards may be obtained by contacting us directly.

How do we look after personal data?

We limit the amount of personal data collected only to what is fit for the purpose, as described above. We restrict, secure and control all of our information assets against unauthorised access, damage, loss or destruction; whether physical or electronic. We retain personal data only for as long as is described above, to respond to your requests, or longer if required by law. If we retain your personal data for historical or statistical purposes, we ensure that the personal data cannot be used further. While in our possession, together with your assistance, we try to maintain the accuracy of your personal data.

How can you access your personal data?

You have the right to request access to any of your personal data we may hold. If any of that information is incorrect, you may request that we correct it. If we are improperly using your information, you may request that we stop using it or even delete it completely.

If you would like to make a request to see what personal data of yours we might hold, you may make a request from our company website.

Where you have previously given your consent to process your personal data, you also have the right to request that we port or transfer your personal data to a different service provider or to yourself, if you so wish.

Where it may have been necessary to get your consent to use your personal data, at any moment, you have the right to withdraw that consent. If you withdraw your consent, we will cease using your personal data without affecting the lawfulness of processing based on consent before your withdrawal.

Your rights over your personal data

Your privacy rights are important to us, and we extend the same rights to every data subject, regardless of where you are located. In relation to the personal data we hold about you, you have the following rights:

• The right to be informed — to be told how we collect and use your personal data, which is the purpose of this notice.
• The right of access — to request a copy of the personal data we hold about you, together with information about how and why we use it.
• The right to rectification — to have inaccurate personal data corrected, and to have incomplete personal data completed.
• The right to erasure — to ask us to delete your personal data where there is no compelling reason for us to continue using it.
• The right to restrict processing — to ask us to limit the way we use your personal data in certain circumstances.
• The right to data portability — to receive the personal data you have provided to us in a structured, commonly used and machine-readable format, and to have it transferred to another organisation where practicable.
• The right to object — to object to our use of your personal data in certain circumstances, including use for direct marketing purposes.
• Rights related to automated decision-making and profiling — not to be subject to a decision based solely on automated processing, including profiling, where that decision produces a significant effect on you.
• The right to withdraw consent — where we rely on your consent to use your personal data, to withdraw that consent at any time, without affecting any use carried out before the withdrawal.
• The right to complain — to lodge a complaint with a supervisory authority if you believe we have not handled your personal data properly. Our Supervisory Authority’s details are set out below.

To exercise any of these rights, or to make a request to see the personal data we hold about you, please use the data subject request form on the Global Genes website. We will respond within the timeframes required by law. In most cases there is no charge, although we may charge a reasonable fee or decline to act where a request is manifestly unfounded or excessive.

Our Data Protection Officer / Privacy Manager

Our Supervisory Authority

You have the right to lodge a complaint with any Supervisory Authority. See our Supervisory Authority contact details below.

Our EU / EEA / UK Representative

Global Genes (RARE-X) has appointed DataRep as its Data Protection Representative in the European Economic Area and the United Kingdom. If you are located in the EEA or the UK, you may contact DataRep in relation to your personal data. When contacting DataRep by post, please address your correspondence to ‘DataRep’ and not to Global Genes or RARE-X, otherwise your request may not reach us. DataRep maintains local contact addresses in countries across the EEA and the UK; a full list is available on our Data Representative page.

You can reach our Representative at: