1. Scope

This policy applies if you are a healthcare professional and OrganoGEN holds personal data about you for any of the following purposes: introducing OrganoGEN-distributed medical devices to your clinical practice; arranging surgeon demos, training, or OR case support; sending opted-in product updates, evidence summaries, or seminar invitations; and maintaining a record of clinical interactions that fall under our quality-management system.

This policy does not apply to personal data you submit in your capacity as a private patient (covered by the general Privacy Policy) or to adverse-event reports concerning OrganoGEN-distributed devices (covered by the Medical-Device Vigilance Privacy Policy).

2. What personal data we collect

From healthcare professionals, OrganoGEN typically collects:

• Name, professional title, and academic / professional qualifications.
• Medical specialty, sub-specialty, and procedural interests.
• Work address, hospital or clinic affiliation, role within the hospital, and (where relevant) participation in the General Healthcare System (GESY).
• Work contact details: email, work phone, mobile (when shared with us for OR-case coordination).
• Records of correspondence with OrganoGEN, including enquiries, demo requests, training attendance, OR-case support records, and clinical follow-up.
• Opt-in preferences for the OrganoGEN newsletter, product launches, evidence summaries, and seminar invitations.
• Public professional information you have published (for example society membership, peer-reviewed authorship, conference presentations) where directly relevant to OrganoGEN's portfolio.

OrganoGEN does not hold patient-identifiable health data as part of the surgeon CRM. Where vigilance reports or clinical case discussions include such data, they are handled under the Medical-Device Vigilance Privacy Policy.

3. How and why we use personal data

OrganoGEN uses healthcare-professional personal data only for the following purposes:

• To introduce OrganoGEN-distributed medical devices that are relevant to your clinical practice.
• To arrange surgeon demos, in-theatre product evaluations, OR case coverage, and first-case support.
• To deliver structured training on OrganoGEN-distributed products (CMC arthroplasty, PRGF protocols, SmartBone® graft preparation, Nanofat™ harvest, and others) at your site, at OrganoGEN's training facility, or at partner clinics.
• To send opted-in product updates, GESY-approval milestones, evidence summaries, and seminar invitations.
• To respond to your enquiries about products, procedures, regulatory documentation, and clinical-evidence references.
• To maintain quality-management records (training attendance, OR-case records, post-market clinical-follow-up evidence) required by OrganoGEN's QMS and EU MDR 2017/745.
• To comply with reporting obligations to manufacturers and to the Cyprus competent authority where required by medical-device legislation.

OrganoGEN does not sell healthcare-professional data, share it for third-party marketing, or use it for automated decision-making with legal effects.

4. How we obtain your personal data

OrganoGEN collects healthcare-professional personal data from:

• You directly, when you send an enquiry, attend a demo, or correspond with OrganoGEN.
• Your hospital, clinic, or department, when they nominate you as a contact for OrganoGEN-distributed products.
• Publicly available professional sources, for the limited purpose of introducing OrganoGEN-distributed products to surgeons working in the relevant fields (for example society directories, hospital staff listings, peer-reviewed authorship).
• OrganoGEN's clinical-support team in the course of OR case coverage, training delivery, or product evaluation.

5. Legal basis for processing

OrganoGEN relies on the following Article 6(1) GDPR bases:

• Article 6(1)(a) consent. For the OrganoGEN newsletter, opt-in clinical updates, and seminar invitations. You may withdraw consent at any time without affecting the lawfulness of prior processing.
• Article 6(1)(b) performance of a contract. Where OrganoGEN has a training, OR-case-support, or clinical-evaluation agreement with you or your hospital, and processing your data is necessary to fulfil it.
• Article 6(1)(c) legal obligation. For record-keeping required by Cyprus or EU medical-device, tax, or quality-management law.
• Article 6(1)(f) legitimate interest. For the surgeon CRM, for introducing OrganoGEN-distributed products to surgeons whose published practice is in the relevant clinical field, for post-market clinical follow-up records, and for standard business administration. The legitimate interest is OrganoGEN's interest in distributing CE-marked, evidence-based medical devices to Cyprus surgeons; balanced against your rights and freedoms; subject to your right to object at any time.

OrganoGEN does not process special-category data (Article 9 GDPR) about healthcare professionals in this context.

6. Data retention

OrganoGEN retains healthcare-professional personal data only as long as necessary for the purpose for which it was collected:

• Active surgeon-CRM relationships. For the duration of the relationship plus a reasonable cooldown period.
• Closed relationships. Up to 10 years after the last clinical interaction, consistent with the Cyprus Commissioner for Personal Data Protection guidance and Cyprus quality-management retention norms.
• Training records. For the period required by the OrganoGEN QMS (typically the design life of the device plus 10 years; 15 years for implantables) per EU MDR 2017/745 Article 10(8).
• OR-case-support records. Same as training records.
• Newsletter opt-in records. Until you withdraw consent (or two years after the last interaction, whichever is shorter).

7. Who has access to your personal data

OrganoGEN shares healthcare-professional personal data only with:

• OrganoGEN personnel. Andreas Samourides as founder and quality manager, and any other authorised OrganoGEN personnel under confidentiality obligations.
• Manufacturers of OrganoGEN-distributed products. Where necessary to coordinate training delivered by the manufacturer (for example KeriMedical-led CMC arthroplasty training, BTI-led PRGF training, IBI SA-led SmartBone training). Each manufacturer acts as a separate data controller for their own training records, under written agreements.
• Hospitals or clinics. Where coordinating OR-case support or training requires sharing your scheduling information with your employer.
• Professional advisors. Cyprus-licensed legal, accounting, and quality-management advisors, under written confidentiality obligations.
• Service providers (data processors). CRM, email, calendar, and document-storage providers retained by OrganoGEN under Article 28 GDPR data-processing terms. A list is available on request to the privacy contact below. [Provisional: list to be finalised during the QMS supplier review.]
• Competent authorities. Where required by Cyprus or EU medical-device or tax legislation.

8. Transfer of personal data outside the EEA

OrganoGEN's primary processing is within the European Economic Area. Where personal data is transferred outside the EEA (for example to US-based manufacturer partners Aspire Medical and Tulip Medical, or to a service provider with US infrastructure), OrganoGEN relies on European Commission adequacy decisions, Standard Contractual Clauses, or other Chapter V GDPR safeguards. A list of recipient countries and applied safeguards is available on request to the privacy contact below.

9. How we protect your personal data

OrganoGEN applies the same technical and organisational measures described in section 10 of the general Privacy Policy, including access controls, TLS in transit, encrypted email at rest, Article 28 data-processing agreements, physical access controls at the Limassol office, and the OrganoGEN QMS aligned with CYS EN ISO 9001:2015.

10. Your rights under GDPR

Subject to the conditions set out in the GDPR, you have the right to access, rectification, erasure, restriction, portability, objection (including objection to direct marketing), and withdrawal of consent. To exercise any right, email info@organogenbiotech.com with a clear description of your request. We respond within one month (extendable by two further months for complex requests, with notice). You also have the right to lodge a complaint with the Cyprus Commissioner for Personal Data Protection (see section 14 of the general Privacy Policy).

11. Status and contact

This wording is provisional and will be reviewed by Cyprus-licensed legal counsel before final publication.

OrganoGEN Limited · Souliou 12, Mesa Geitonia, Limassol 4000, Cyprus
Privacy and general enquiries: info@organogenbiotech.com · Phone: +357 95 707111

Last revision date: 2026-05-13. Version: 1.0 (provisional, pre-counsel-review).