GDPR NOTICE Data Protection Notice For EU/EEA Patients and Other Individuals

Biodesix, Inc. (“Biodesix”) is providing this notice for individuals residing in the European Union/European Economic Area from whom we acquire biological (i.e., blood or urine) specimens, as well as other individuals involved in the healthcare process. It explains how we collect and process your personal data in connection with our clinical laboratory services. 

Who We Are

Biodesix is a clinical laboratory company headquartered and principally operating in the United States. We collect biological samples (blood or urine) from patients for the following purposes:

• Clinical laboratory services. If ordered through your health care provider, we provide certain testing services for particular types of cancer. We may also receive biological samples for testing through collaborative agreements with other healthcare organizations. 

Data Collection

We only collect personal data in relation to the services we provide, and limit our data collection to data which is appropriate and proportionate to the reasons for our collection.  Generally, we will collect the following information in connection with our provision of testing services:

• Patient Name
• Patient mailing address
• Patient gender and age
• Patient email
• Patient phone number
• Patient Account Numbers for purposes of payment/insurance
• Contact information for the Patient’s healthcare provider(s) associated with the purpose of our testing
• Tests ordered
• We also obtain, in the course of our testing, medical information about the patient which is derived from the tests themselves.

If you are a healthcare provider or other individual involved in the treatment, payment, or operation of health care, we may, in connection with our provision of testing services, collect the following information about you:

• Name
• Mailing address
• Email
• Phone Number(s)

Data Processing

We use the personal data of patients and other individuals only for the intended health care purposes associated with:

• obtaining biological samples
• performing required testing
• reporting results, and
• obtaining payment.

If the patient’s healthcare professional contacts us directly, we will, after appropriate authentication, discuss our testing and results with them.

We may also use the data we collect to fulfill our regulatory and legal obligations, such as in relation to audits and checking to ensure that our testing equipment is working properly, and to comply with oversight agency inspections. We may use information in de-identified or anonymized format for public health purposes, such as to report outbreaks or similar irregularities to health officials to help keep communities and the people who live in them safe and healthy. In accordance with applicable laws, various de-identified or anonymized data may also be used to aid in tracking health trends and needed areas of research.

Access Limitations and Sharing Your Data

We strictly limit access to patient personal data to authorized members of Biodesix’s workforce and contractors who assist in the testing and test reporting process. We train these individuals in advance, with annual refresher training, on appropriate privacy and security requirements. Before allowing any contractor access to the data, we enter into appropriate contractual provisions requiring contractor compliance with privacy law and our instructions on data processing. 

We may also share certain personal data received in relation to the services described in this notice with third parties working with Biodesix, such as third-party laboratories with whom we have collaborations for performing certain specialized laboratory testing, as well as those that assist us with public health and safety aspects of our business. We never sell or share personal data pertaining to patients or other individuals with third parties for their own separate use. Should we share your data with a third party, the third party must provide written assurances that they will only process the data on behalf of Biodesix and subject to Biodesix’s instructions and that they will also ensure appropriate security measures to keep the personal data strictly confidential, consistent with applicable laws and regulations.

To the extent that we are required to provide access to any personal data to third parties who are not our business partners, such as in connection with regulatory audits, to fulfill regulatory reporting obligations to health oversight agencies, or in the event of any legal situations, we take steps to limit the data to that which is required for the specific purpose and take steps to ensure that the data are adequately safeguarded. For legal situations, where feasible, we take steps to inform the individual before any data is provided to the third-party, and if not feasible, will take reasonable steps to inform him/her as soon as practical thereafter.