1. Scope of this policy

This policy applies to personal data that OrganoGEN Limited processes in connection with: (a) your visit to organogenbiotech.com; (b) enquiries you send by email, phone, or any of our contact forms; (c) follow-up correspondence regarding our distributed medical devices or training events; and (d) routine business dealings with hospital procurement teams, surgeon partners, and other contacts.

Two specialised policies cover specific contexts: a Healthcare Professionals Privacy Policy for the surgeon CRM and clinical-marketing activities, and a Medical-Device Vigilance Privacy Policy for incident and adverse-event reporting under EU MDR 2017/745. If a specialised policy applies, it takes precedence over the general statements in this document.

2. Who we are (data controller)

OrganoGEN Limited, a private company incorporated in the Republic of Cyprus, is the data controller for personal data covered by this policy.

• Registered office. Souliou 12, Mesa Geitonia, Limassol 4000, Cyprus.
• Email. info@organogenbiotech.com (Andreas Samourides, founder and quality manager, acts as the named privacy contact). OrganoGEN is below the scale at which Article 37 GDPR requires a formal Data Protection Officer; this contact functions as the named point of accountability.

3. What personal data we collect

OrganoGEN collects personal data only when it is voluntarily provided to us or when it is technically necessary for the website to function. Categories include:

• Contact details. Name, role, organisation, work email, phone, and the content of your message when you contact us via the website, email, phone, or in person.
• Professional information. For surgeons, hospital procurement teams, and other healthcare partners, role, hospital affiliation, specialty, and (where relevant) prescribing or implanting interests. Where this professional information includes data about your medical specialty or clinical practice, see the Healthcare Professionals Privacy Policy.
• Vigilance data. If you report an adverse event or incident relating to an OrganoGEN-distributed device, see the Medical-Device Vigilance Privacy Policy for the categories collected.
• Technical data. When you visit the website we automatically log technical information such as your IP address, browser type, device type, referring page, and pages visited, for security, debugging, and basic analytics purposes.
• Cookies and similar technologies. See section 11 below.

OrganoGEN does not routinely collect special-category data (Article 9 GDPR) such as health data of identified patients. Where a vigilance report or surgeon enquiry incidentally contains such information, it is processed under the vigilance policy or the healthcare-professionals policy as applicable.

4. How we obtain your personal data

OrganoGEN collects personal data from the following sources:

• Directly from you. When you submit an enquiry, request a quotation, register for a training event, or contact OrganoGEN by phone, email, or in person.
• From your employer or partner organisation. When a hospital procurement team or surgical-clinic administrator names you as the relevant contact for OrganoGEN-distributed products.
• From publicly available professional sources. Where we identify surgeons working in fields covered by our portfolio (for example through professional directories, medical-association membership lists, or public hospital staff listings) for the limited purpose of introducing OrganoGEN-distributed products.
• Automatically when you use the website. Technical data and cookies as described in sections 3 and 11.

5. How and why we use personal data

OrganoGEN uses personal data only for the following purposes:

• To respond to your enquiry and provide information on OrganoGEN-distributed products, procedures, and GESY coverage.
• To coordinate surgeon demos, training, OR case coverage, and product evaluations.
• To fulfil hospital procurement, quotation, and tender requests, including issuing invoices and providing regulatory documentation.
• To process and forward medical-device vigilance reports as required by EU MDR 2017/745 and the Cyprus competent authority (see the vigilance policy).
• To send occasional product, training, and clinical-evidence updates to healthcare professional partners who have opted in (see the healthcare-professionals policy).
• To maintain business records required by Cyprus tax, accounting, and statutory retention rules.
• To protect the website and our information systems from fraud, abuse, and security incidents.
• To comply with legal, regulatory, or law-enforcement obligations applicable in the Republic of Cyprus and the European Union.

OrganoGEN does not sell personal data, share it with third parties for their own marketing, or use it for automated decision-making or profiling that produces legal or similarly significant effects on you.

6. Legal basis for processing

OrganoGEN relies on the following Article 6(1) GDPR legal bases:

• Article 6(1)(a) consent. For optional marketing emails, the OrganoGEN newsletter, and any processing where you have given specific consent.
• Article 6(1)(b) performance of a contract. When processing is necessary to fulfil a hospital procurement contract, a surgeon training agreement, or a similar arrangement to which you (or your organisation) are a party.
• Article 6(1)(c) legal obligation. Where processing is required by Cyprus tax, accounting, medical-device, or vigilance legislation, or by EU regulations applicable to medical-device distributors.
• Article 6(1)(f) legitimate interest. For responding to enquiries, maintaining and developing the surgeon CRM, running standard business administration, securing the website, and pursuing OrganoGEN's interest in distributing medical devices in Cyprus. The legitimate interests are balanced against your rights and freedoms, and you may object at any time as described in section 13.

Where processing is based on consent, you may withdraw your consent at any time without affecting the lawfulness of processing carried out before the withdrawal.

7. Who we share personal data with

OrganoGEN shares personal data only with the following categories of recipients, and only as necessary for the purposes set out above:

• OrganoGEN personnel. Andreas Samourides as founder and quality manager, and any other authorised OrganoGEN personnel acting under appropriate confidentiality obligations.
• Manufacturers of OrganoGEN-distributed products. Where necessary for technical support, vigilance reporting, training, or warranty handling. Each manufacturer acts as a separate data controller (or, in some cases, a joint controller for vigilance reports) under written terms.
• Hospitals, clinics, and the General Healthcare System (GESY). Where necessary to fulfil a procurement, tender, or reimbursement obligation, under supplier code ZC1093.
• Professional advisors. Cyprus-licensed legal, accounting, tax, and quality-management advisors retained by OrganoGEN, under written confidentiality obligations.
• Service providers (data processors). Web hosting, email, calendar, CRM, accounting software, document storage, and similar service providers retained by OrganoGEN under written data-processing terms compliant with Article 28 GDPR. Current named processors include Google Ireland Limited (website analytics, loaded only with your consent), Microsoft Ireland Operations Limited (website session insights, loaded only with your consent), Formspree, Inc. (United States; processes contact-form submissions), and Hostinger (web hosting). A full list of current data processors is available on request to the privacy contact in section 2.
• Cyprus competent authorities. The Cyprus Drugs Council (CyDC) or other competent authority where required by medical-device vigilance legislation.
• Law-enforcement or regulatory bodies. Where OrganoGEN is legally required to share data, including in response to a valid court order or statutory request.

OrganoGEN does not share personal data with online advertising networks or third-party data brokers.

8. International transfers outside the EEA

OrganoGEN's primary processing is within the European Economic Area (EEA). Some service providers (for example email and document storage) and some manufacturer partners (for example Aspire Medical Innovation and Tulip Medical, both based in the United States) are located outside the EEA. In addition, Formspree, Inc. processes contact-form submissions in the United States, and Google and Microsoft may transfer website analytics data collected with your consent to the United States. Where personal data is transferred outside the EEA, OrganoGEN relies on one or more of the following safeguards:

• The EU-US Data Privacy Framework adequacy decision, for United States recipients certified under it.
• European Commission adequacy decisions, where available for the destination country.
• Standard Contractual Clauses approved by the European Commission under Article 46(2)(c) GDPR.
• Other appropriate safeguards under Chapter V GDPR.

A list of countries to which data is transferred and the safeguards applied is available on request to the privacy contact.

9. How long we retain personal data

OrganoGEN retains personal data only as long as necessary for the purpose for which it was collected, plus any further period required by Cyprus law. Retention defaults are:

• General enquiries with no further contact. Up to 12 months from the date of last contact, then deleted.
• Active customer / surgeon / hospital relationships. For the duration of the relationship.
• Closed customer relationships. Up to 10 years after the end of the relationship, consistent with the Cyprus Commissioner for Personal Data Protection guidance and Cyprus accounting and tax retention requirements.
• Statutory records (tax, accounting, regulatory). For the period required by the applicable Cyprus or EU rule (typically 6–10 years).
• Vigilance reports. For the period required by EU MDR 2017/745 (typically at least 10 years after the device is placed on the market, or 15 years for implantable devices), as specified in our agreements with the relevant manufacturer.
• Website logs and analytics. Technical logs are retained for short operational periods (typically up to 30 days for raw logs, longer for aggregated statistics).

10. How we protect your personal data

OrganoGEN applies appropriate technical and organisational measures (Article 32 GDPR) including:

• Access controls, authentication, and least-privilege access within OrganoGEN's systems.
• Encryption of email at rest and in transit through the chosen mail provider; TLS for all web traffic.
• Written confidentiality obligations on all professional advisors and service providers.
• Written data-processing agreements with all data processors as required by Article 28 GDPR.
• Physical access controls at the Limassol office for paper records and devices.
• Routine review of the OrganoGEN Quality Management System, with information-security considered in scope alongside CYS EN ISO 9001:2015 certification.

While we take these measures, no online transmission or storage system is ever 100% secure; we cannot therefore guarantee absolute security.

11. Cookies and similar technologies

The OrganoGEN website uses a minimal set of cookies and similar technologies. On your first visit a consent banner asks you to accept all cookies, reject all non-essential cookies, or customise your preferences. You can re-open the banner at any time via the Cookie preferences link in the footer, or by clearing your browser storage for this site.

Categories used

• Strictly necessary (always on). Required for the site to operate and to record your consent choice. No tracking, no advertising.
• Analytics (optional, off by default). With your consent, the site loads Google Tag Manager, Google Analytics 4, and Microsoft Clarity to measure which pages are most useful and how visitors interact with them (including clicks, scrolling, and pointer movement in anonymised session insights). These scripts load only after you press Accept all or toggle Analytics on; until then they are inert placeholders and no analytics requests leave your browser.
• Marketing (optional, off by default). OrganoGEN does not run ad campaigns or share data with third-party advertising networks. This category exists in the consent banner for transparency and forward-compatibility only.

Inventory

The site stores the following items in your browser.

Strictly necessary (always on)

Name	Type	Purpose	Retention
og_consent	localStorage (similar to a cookie)	Records your cookie-banner choice so we do not ask again on every page load.	Until you clear browser storage or reset preferences.

Analytics (set only after you consent)

Name	Type	Purpose	Retention
_ga	Cookie (Google Analytics)	Distinguishes returning visitors for anonymous usage statistics.	2 years
_ga_E5CJ8MZ7D7	Cookie (Google Analytics)	Keeps the measurement session for this site's GA4 property.	2 years
_clck	Cookie (Microsoft Clarity)	Stores a per-browser identifier so Clarity can group your page views into session insights.	1 year
_clsk	Cookie (Microsoft Clarity)	Links the pages viewed in one visit into a single session.	1 day

Microsoft Clarity may also set a small number of additional short-lived cookies of its own; none are used for advertising.

If you later withdraw your analytics consent via the Cookie preferences link, these scripts stop loading from your next page view. Cookies already set by Google or Microsoft can be removed through your browser settings, and in any case they expire on the schedule above. If OrganoGEN ever adds any other non-essential script, this inventory will be updated first and the script will only load after you opt in via the consent banner.

You can accept, refuse, or delete cookies through your browser settings at any time. Refusing strictly-necessary cookies may prevent parts of the site from functioning correctly. OrganoGEN does not use advertising cookies. With your consent, Microsoft Clarity produces anonymised session insights (which pages you view and how you click and scroll); these are used solely to improve the site, never to build advertising profiles.

12. Children's data

The OrganoGEN website is intended for healthcare professionals, hospital procurement teams, and adult patients or carers. We do not knowingly collect personal data from children under 18 years of age. If a child has provided personal data without parental consent, please contact the privacy contact in section 2 and we will delete it promptly.

13. Your rights under GDPR

Subject to the conditions set out in the GDPR, you have the right to:

• Access the personal data we hold about you (Article 15).
• Have inaccurate personal data rectified (Article 16).
• Have personal data erased in certain circumstances ("right to be forgotten", Article 17).
• Have processing restricted in certain circumstances (Article 18).
• Receive your personal data in a structured, commonly-used, machine-readable format and have it transmitted to another controller (data portability, Article 20).
• Object to processing carried out on the basis of legitimate interest, including any direct marketing (Article 21).
• Withdraw consent at any time where processing is based on consent (Article 7(3)).
• Not be subject to a decision based solely on automated processing (Article 22) - OrganoGEN does not carry out such decision-making.

To exercise any of these rights, email info@organogenbiotech.com with a clear description of your request. We will respond within one month (extendable by two further months for complex requests, with notice).

14. Right to lodge a complaint

If you believe OrganoGEN's processing of your personal data infringes the GDPR or Cyprus data-protection law, you have the right to lodge a complaint with the Cyprus supervisory authority:

Office of the Commissioner for Personal Data Protection of the Republic of Cyprus
1 Iasonos Street, 1082 Nicosia, Cyprus
Phone: +357 22818456
Email: commissioner@dataprotection.gov.cy
Website: www.dataprotection.gov.cy

We would, however, appreciate the opportunity to address your concern directly before you contact the Commissioner. Please email info@organogenbiotech.com first.

15. Changes to this policy

OrganoGEN may update this Privacy Policy from time to time. The most recent revision date is displayed below. Material changes will be communicated through this page; we encourage you to review the policy periodically.

16. Status

This wording is provisional and will be reviewed by Cyprus-licensed legal counsel before final publication. Items marked [Provisional] in this policy will be completed during the legal review. For specific data-protection enquiries, please contact info@organogenbiotech.com.

17. Contact

OrganoGEN Limited · Souliou 12, Mesa Geitonia, Limassol 4000, Cyprus
Email: info@organogenbiotech.com

Last revision date: 2026-08-17. Version: 1.1 (provisional, pre-counsel-review).