Contact us

1. About this patient information notice

You are receiving this patient information notice because your treating physician intends to submit your personal data, including genetic information, to WinQure Medicine ApS (hereinafter referred to as “WinQure Medicine”, “we”, or “us”) to enable scientific, clinical, and regulatory assessment of your genetic disease and associated variant to determine whether initiation of a new precision antisense oligonucleotide (“ASO”) therapeutic development programme may be feasible and appropriate for you.

This patient information notice includes information on how we process your personal data and your data protection rights when your treating physician submits your information to us.

We process your personal data in accordance with the EU General Data Protection Regulation (“GDPR”) and other applicable data protection legislation. We are committed to complying with applicable data protection legislation for all processing activities conducted by us as a controller and will treat your personal data with the greatest of care. For more information on how we process personal data, please visit https://winqure.com/privacy-policy/.

In this patient information notice, we use several terms from the GDPR, for example “processing”, “controller” and “data processor”. The terms have the same meaning here as in the GDPR.

2. Who is responsible for processing your personal data

We are the controller of the personal data processed for the purposes described in this patient information notice. This means that we are responsible for ensuring that the processing is compliant with applicable data protection legislation.

Our contact information is:

3. What personal data do we process and for which purposes?

When your treating physician submits your information to us, we process it to assess whether you may be eligible for a personalised ASO therapeutic development programme. As part of this assessment, WinQure Medicine may review the submitted information for scientific, clinical, regulatory, manufacturing, commercial, and programme prioritisation purposes.

For these purposes, we will process your contact information and patient information, including age, sex, country of residence and date of birth. In addition, we will process genetic and health information about you, including information about your genetic diagnosis, gene and disease characterization, clinical phenotype, organ systems affected, primary symptoms and disease burden, current standard of care and treatment history, biomarkers and clinical endpoints, treatment goals and expected outcomes, genetic reports and documentation related to your medical and treatment history.

The applicable legal basis for this initial assessment is your explicit consent pursuant to Article 6(1)(a) and Article 9(2)(a) of the GDPR. Consent may be withdrawn at any time by sending an e-mail to [email protected]. You may also contact your treating physician. Your treating physician is responsible for obtaining your consent and for adhering to all other laws and regulations applicable to the disclosure of your personal data to us. For example, if your treating physician is located in Denmark, they are required to obtain and maintain written consent from you and record this in your medical record in accordance with the Danish Health Act (Sundhedsloven) §§ 43-44, or comply with any similar or additional national requirements if located elsewhere.

Submission of your information does not create any obligation on the part of WinQure Medicine to initiate a new development programme, provide treatment, sponsor a clinical study, or offer future access to a therapeutic product. Each submission is evaluated individually. If it is assessed and decided that you are eligible for development and treatment for ASO therapies, other legal bases under the GDPR may apply, such as Article 6(1)(c) or (e), in conjunction with Article 9(2)(i) or (j) of the GDPR. Where this processing applies to you, detailed information, including the applicable legal basis and retention period, will be provided to you.

4. What is the source for the personal data we process?

The personal data we process is received from your treating physician or directly from you.

5. What are your rights when we process your personal data?

If you have consented to the processing, you can change your mind at any point and withdraw your consent. The withdrawal of consent will not affect the lawfulness of processing based on consent before its withdrawal.

Furthermore, you have a right to:

To exercise your rights, please contact us at [email protected]. You can find out more about your rights on the website of the Danish Data Protection Authority (www.datatilsynet.dk).

WinQure Medicine does not conduct automated decision-making, including profiling.

6. How long will your personal data be stored?

Your personal data will be retained for as long as is necessary for the purposes for which it was collected. When your treating physician submits information to us, we will retain it for as long as necessary to enable the scientific, clinical, and regulatory assessment described in section 3 above.

Your personal data will also be deleted upon withdrawal of consent, unless a statutory retention obligation requires us to retain it for a longer period. The withdrawal of consent will not affect the lawfulness of processing based on consent before its withdrawal.

7. Do we share your data with anyone, or transfer your data to other countries outside the EU/EEA?

a. Data processors

Your personal data will be available to those of our suppliers who process personal data on our behalf. To safeguard your rights, we have entered into data processing agreements with these suppliers which, amongst other things, ensure that your personal data cannot be used for any other purpose. Our suppliers have a corresponding duty to enter into data processing agreements with their sub-processors that impose the same obligations as those imposed on our suppliers. Some of our suppliers are located in countries outside the EU/EEA. To ensure your privacy, such transfers will take place in accordance with Chapter V of the GDPR. For all transfers to countries or third parties outside the EU/EEA not subject to an adequacy decision by the EU Commission, we will enter into the EU Commission’s Standard Contractual Clauses and conduct all required assessments. The EU Standard Contractual Clauses are available on the EU Commission’s website.

b. Other third parties

We do not pass on your personal data to others unless there is a lawful basis for such disclosure. Examples of such a basis will typically be your consent or a legal obligation that requires us to disclose the information.

Where sharing is necessary, it occurs only in limited and controlled circumstances, including:

Pseudonymised data will be submitted to regulatory authorities when required by law and may feature in scientific publications or presentations in accordance with accepted research practice.

Disclosure of personal data may entail that your personal data is transferred to third parties located in countries outside the EU/EEA. To ensure your privacy, such transfers will take place in accordance with the applicable data protection legislation, as further outlined above.

8. Security

We are committed to the security of personal data. We implement appropriate technical and organisational measures to protect your personal data against unauthorised access. These measures are regularly reviewed and updated.

Access to personal data, in particular special categories of personal data, is strictly limited to authorised personnel who require access for the purposes described in this patient information notice.

9. What should you do if you want to file a complaint about our processing and handling of your rights?

If you believe that our processing of your personal data fails to comply with the requirements set out in this patient information notice, or that we have in any other way contravened applicable data protection legislation, you may submit a complaint to the relevant data protection authority.

Information on how to submit a complaint to the Danish Data Protection Agency can be found here: https://www.datatilsynet.dk/borger/klage/saadan-klager-du