For the donor programme: application, screening and donation
This notice explains what happens to your data if you apply to, or take part in, the donor programme. Donation is a different relationship from being a patient, with different data, a different controller and different retention rules — which is why it has its own notice.
MicroBiome Bank Kft.
H-1118 Budapest, Ménesi út 104. II. ép.
Hungary
Company number 13-09-189941
Email: privacy@microbiomebank.com
MicroBiome Bank Kft. is a Hungarian healthcare provider, and it is the controller for the donor programme.
2. What we collect
Identification data: family name, given name, sex, date and place of birth, mother's name.
Social security number (TAJ), which the documentation of healthcare activity in Hungary requires.
Contact and address data: email address, telephone number, address, city, postcode, country, preferred language.
Screening and health data generated by our donor screening framework: bacteriological, virological, parasitological and serological testing, stool analysis, and a detailed medical history. This is a special category of personal data under Article 9 of the GDPR.
Data retrieved from the Hungarian eHealth space (EESZT), as described in section 4.
Your donor identifier and the LOT numbers of the material prepared from your donation, which make every dispatched capsule traceable.
3. Why we process it, and on what legal basis
Assessing your application and screening you. Legal basis: your explicit consent (Article 9(2)(a)), given in the Data Processing Consent Statement, and the steps taken at your request before entering into a contract (Article 6(1)(b)).
Running the donor programme and preparing the donation. Legal basis: performance of a contract (Article 6(1)(b)); for health data, Article 9(2)(a) and, where the activity is health care under professional responsibility, Article 9(2)(h).
Traceability and safety. Every dispatched capsule carries a LOT number traceable back to the donation, so that a safety question can be followed up. Legal basis: legal obligation (Article 6(1)(c)) and Article 9(2)(i) — public health and the safety of health care.
Statutory reporting, including transfer to the EESZT. Legal basis: legal obligation (Article 6(1)(c)).
Scientific research, for which experience derived from the data and from the use of the donation is used in anonymised form only. Once anonymised the data is no longer personal data.
4. EESZT — the Hungarian eHealth space
As a Hungarian healthcare provider we transfer data to the EESZT where the law requires it. With your consent, we also access the health data, information and documents available about you in the EESZT — during your participation in the donor programme and for a further two months after your last donation. To make this possible you set the access permission yourself on the EESZT citizen portal, under "Önrendelkezés". You can change or revoke that permission there at any time, independently of this notice.
5. Who we share it with
Laboratories carrying out the screening analyses.
MicroBiome Bank Ltd. (2 Brandon Road, Braintree, Essex, CM7 2NL, England), where the material prepared from a donation is supplied to its patients. What travels with the product is the LOT number, not your identity.
Zapier Inc. and monday.com Ltd. — our form relay and case-handling systems. An application submitted through the website reaches our team this way. Both act as processors.
The EESZT and public health authorities, as described in section 4 and where the law otherwise requires it.
IT and hosting providers, as processors.
We never disclose a donor's identity to a recipient, and we never disclose a recipient's identity to a donor.
6. How long we keep it
Medical documentation created about you: 30 years from creation, and discharge summaries 50 years, under the Hungarian healthcare data legislation. This is a legal obligation and it survives the withdrawal of your consent.
Traceability records linking a donation to its LOT numbers: for as long as product safety law requires, so that any dispatched unit can be traced back.
Applications that did not lead to donation: deleted after 12 months.
EESZT access: ends two months after your last donation.
7. Withdrawing consent
You may withdraw your consent at any time, with immediate effect and without giving a reason, by written statement — by post to H-1118 Budapest, Ménesi út 104. II. ép., or by email to privacy@microbiomebank.com. Withdrawal does not affect the lawfulness of processing carried out beforehand, and it does not release us from documentation we are required by law to keep, or from the traceability of material already dispatched.
8. International transfers
Some of the processors named above are established outside the European Economic Area, or process data there. Where that happens we rely on the safeguards permitted by data protection law — principally the European Commission's Standard Contractual Clauses together with the UK International Data Transfer Addendum, and an adequacy decision where one applies.
9. Security and professional secrecy
Screening data is covered by medical professional secrecy. We apply encryption in transit, access control limited to staff involved in the programme, pseudonymisation through the donor identifier and the LOT system, and protection of our forms against automated abuse.
10. Your rights
Access your data and receive a copy.
Rectify inaccurate or incomplete data. In medical documentation a correction is recorded alongside the original entry rather than replacing it.
Erasure, subject to the retention periods in section 6.
Restrict processing, and object to processing based on legitimate interests.
Portability — receive your data in a structured, commonly used, machine-readable format.
Withdraw consent, as described in section 7.
Complain to a supervisory authority (Article 77). In Hungary this is the Nemzeti Adatvédelmi és Információszabadság Hatóság (naih.hu). You may also complain to the authority where you live.
11. The law that applies
Regulation (EU) 2016/679 (GDPR); Act CXII of 2011 on informational self-determination and freedom of information; Act CLIV of 1997 on healthcare; and Act XLVII of 1997 on the processing and protection of health and related personal data.
12. Changes to this notice
We may update this notice. Any change is published on this page with a new "Last updated" date.
