Privacy policy
How we handle personal data when you use this website, open a case or work with us.
Last updated: 5 November 2026
This website is run by Hemafund Assistance OÜ ("Hemafund Assistance"). We coordinate medical, biological and logistical requests. To do that we often need to work with sensitive information, so this policy explains plainly what we collect, why, who sees it and what you can do about it.
It applies to this website, the client zone, the case mailbox and our work on your case. It uses the terms of the EU General Data Protection Regulation (GDPR).
Who is responsible for your data
The controller is Hemafund Assistance OÜ, registry code 17640123, Harju maakond, Tallinn, Lasnamäe linnaosa, Pae tn 25-47, 11414, Estonia.
For any question about your data or this policy, write to office@hemafund.healthcare. Please include your Case ID if you have one.
The data we process
Your request
Your full name, email address, the type of request and anything you write in the form, together with the language you used and a record of the confirmations you gave.
Correspondence
Emails you send to and receive from the case mailbox, including attachments, and internal notes our coordinators make about your case.
Documents
Files you add on your case page or send by email, and files we receive from partners for your case. These can include medical records and biobank documents.
Health and genetic data
Your choice of a medical request type, what you tell us about your health, and documents such as test results. Biobank documents can contain genetic data, for example HLA typing. The GDPR gives these categories special protection.
Payment data
The payment requests we send you, what they cover, and whether and when your bank transfer arrived. We accept bank transfers only and do not collect card details.
Technical and security data
IP address, time of access, sign-ins and sign-outs, document downloads and rate-limit counters. We keep these to protect the service and your case.
Business contacts
The names and work contact details of people who write to us on behalf of a company, clinic or other partner.
Why we process it and on what legal basis
Answering your request
To review what you asked for and reply. Legal basis: steps you ask us to take before a contract, Art. 6(1)(b) GDPR.
Coordinating your case
To keep your case, correspond with you, keep your documents and arrange the next steps. Legal basis: our contract with you, Art. 6(1)(b) GDPR.
Health and genetic data
Only with your explicit consent, Art. 9(2)(a) GDPR. The optional consent on the Open a case form covers what you include in your enquiry, solely to assess and respond to it. Before we work with medical documents in a case or share health data with a partner, your coordinator asks for your explicit consent in writing. You can leave the form consent unticked, but please then do not include health details in your message.
Signing in
To let you reach your case page with a link from an email, without a password. Legal basis: Art. 6(1)(b) GDPR.
Payments and accounting
To request and record payments and to meet accounting and tax duties. Legal basis: Art. 6(1)(b) and (c) GDPR.
Security
To keep an access log, limit repeated attempts and check uploaded files for viruses. Legal basis: our legitimate interest in protecting the service and the data in it, Art. 6(1)(f) GDPR. You have the right to object, as described below.
Emails without a case
To read and answer messages from people who have no case with us, such as doctors or new enquirers. Legal basis: our legitimate interest in answering, Art. 6(1)(f) GDPR, or steps before a contract, Art. 6(1)(b) GDPR.
Business contacts
To communicate with companies and partners. Legal basis: our legitimate interest in running our business, Art. 6(1)(f) GDPR, or a contract with your organisation, Art. 6(1)(b) GDPR.
Email, sign-in links and files
We communicate through the case mailbox. Emails are read into our case system and the originals remain with our email provider. Email is protected in transit by TLS where the other side supports it, but it is not end-to-end encrypted. For sensitive or large files, use Add documents on your case page rather than an email attachment.
Sign-in links work once. A link you request on the Sign in page is valid for 15 minutes; a link in a case email is valid for 7 days. Anyone who has an unused link can open your case, so please do not forward these emails. After you sign in, you stay signed in for up to 30 days on that device unless you sign out.
Files are kept in private storage, can be up to 200 MB each and are checked for viruses before they can be downloaded.
Who receives your data
We do not sell personal data and do not use it for advertising.
Our team
Coordinators and administrators of Hemafund Assistance. Every team member with access to our case system can see every case. Each is bound to confidentiality, and access is logged.
Service providers working for us
Providers of hosting, file storage, email and backups, and our developers and technical support. They act on our instructions under data processing agreements. Case data is stored on servers in the European Union.
Partners for your case
Doctors, clinics, laboratories, biobanks, transport companies and Hemafund Group, which provide their own services under their own responsibility. They receive data only for a specific case, only as far as needed, and for health data only with your explicit consent.
Employers and organisations
If your employer or another organisation arranges or pays for our services, we do not pass your health information to them without your separate explicit consent.
Authorities and advisers
Public authorities, courts and professional advisers, where the law requires it or where it is needed to establish or defend legal claims.
Transfers outside the European Union
Our team and developers work from the European Union, and we do not routinely send your data outside it.
Some partners are based elsewhere. In particular, Hemafund Group operates in Ukraine, for which the European Commission has not adopted an adequacy decision, so the level of data protection there may be lower than in the EU and you may have fewer ways to enforce your rights. We send data to such a partner only for your specific case, when you need that partner's service. Before doing so we tell you what would be sent and to whom, and we rely on your explicit consent to the transfer, Art. 49(1)(a) GDPR, or on the transfer being necessary for a contract concluded in your interest, Art. 49(1)(b) and (c) GDPR.
How long we keep data
We keep personal data only as long as we need it for the purposes above. How long that is depends on the following criteria: whether your request led to a case and whether the case is still active; how long a biological asset you asked us to help manage stays in storage, which can be many years; legal retention duties, particularly accounting records; and the time within which legal claims can be brought.
A few things have fixed limits. Used and expired sign-in links are removed 30 days after they expire. Sessions end when they expire. Files whose upload was not completed are removed after 24 hours.
We do not yet apply a fixed automatic schedule to other records, such as requests, correspondence, documents and access logs. We delete or anonymise them by hand when they are no longer needed or when you make a valid request, and we will publish fixed periods here when we set them. Backups and copies at our email provider may take longer to clear.
Your rights
You can ask us for access to your data and a copy of it, and to correct it, erase it or restrict how we use it. You can ask to receive data you gave us in a portable format. You can object at any time to processing based on our legitimate interests, for reasons relating to your particular situation.
Write to office@hemafund.healthcare. It is free of charge, and we answer within one month. To protect your data, we may first confirm that you control the email address on the case. Some data may have to stay for legal reasons, such as accounting records; we will tell you if so.
Withdrawing your consent
You can withdraw any consent at any time, as easily as you gave it: write to office@hemafund.healthcare, ideally with your Case ID. We confirm by email and stop the processing that relied on that consent. Withdrawal does not affect what we lawfully did before it. Without consent to process health data we may no longer be able to coordinate parts of your case; your coordinator will tell you what this means.
Complaints
We would like to hear from you first, but you always have the right to complain to a supervisory authority. Our lead authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, Estonia, info@aki.ee, www.aki.ee. You can also complain to the authority where you live or work; in Germany, this is the data protection authority of your federal state.
What you have to provide
We need your name and email address to answer you and keep a case; without them we cannot help. Everything else in the form is optional. Coordinating a medical or biological request usually does require health information, so we may not be able to carry out some services without it.
Data from other sources and about other people
We may receive data about you from biobanks, clinics, doctors and other partners involved in your case, or from a person who writes to us on your behalf, for example a relative. The categories are those listed above.
If you send us data about someone else, such as your child or a relative, please make sure you are entitled to do so and let them know where you can. Biological material stored for a child may belong to someone who is now an adult; we may ask for proof that you have authority before giving access to their data or arranging anything for their material.
Automated decisions
We do not make decisions about you solely by automated means, and we do not profile you. A coordinator reviews every request personally.
Changes to this policy
When our processing changes, we update this page and the date at the top. If a change affects what you consented to, we ask you again.