Privacy Notice – Hand Scan

We will obtain your personal data as described herein directly from you when you use the Hand Scan or when you engage with one of our sales representatives and such representative assists you to complete a Hand Scan. Completing a Hand Scan will involve a step where you or the sales representative will scan your hand (i.e., take a picture of your hand), and from this image we will be able to measure your hand size, including palm width and finger length. This is described in more detail under section 4 below.

We only process your personal data to the extent permitted in accordance with applicable data protection legislation. This means inter alia that we need to have a legal basis for the purposes for processing your personal data, which in the Hand Scan context means the following legal basis:

Legitimate interests – the processing is necessary for the purposes of the legitimate interests pursued by us or by a third party, provided that they are not overridden by your interests or fundamental rights or freedoms (in which case the processing would not be allowed).

Below, we explain more about the categories of personal data we process, for what purposes we process them and for how long we store your personal data.

What we do and why: 

We will process your personal data for the purpose of generating and providing you with your requested Personalized Hand Performance Report, which is done by sending it to your email address.

The Personalized Hand Performance Report will include tailored product recommendations, which are provided on the basis of your personal data used to complete the Hand Scan.

The personal data that we process:

• Diversity data; including gender, age, professional role, speciality and location.
• Preference data; including information regarding preferred glove materials, glove thickness and grip requirements.
• Measured hand image; derived from the hand scanning.
• Contact information; including email address.

Our legal basis for processing:

Legitimate interest, wherein our legitimate interest is to generate and provide you with the Personalized Hand Performance Report (including product recommen-dations), which you have requested from us.

How we share and transfer your data:

We will share your personal data with the following recipients;

• Suppliers of IT-services; and
• Our Mölnlycke affiliates

Mölnlycke will not transfer your personal data to countries outside the EU/EEA within the scope of this processing activity.

How long we keep your data:

We will process and keep your personal data for the period of time you are using the mobile application and the time required to send you the Personalized Hand Scan Report. The collected data will be transformed into anonymised data after sending the Personalized Hand Scan Report. Such anonymous data cannot directly identify you as a person and may be processed by us for an indefinite period of time. For the sake of clarity, this anonymised data is not personal data.

We have taken measures to ensure that your personal data is handled in a safe way. For example, access to systems where personal data is stored is limited to our employees and service providers who require it in the course of their duties. Such parties are informed of the importance of maintaining security and confidentiality in relation to the personal data we process. We maintain appropriate safeguards and security standards to protect your personal data against unauthorized access, disclosure or misuse. We also monitor our systems to discover vulnerabilities.

We strive to always process your personal data within the EU/EEA. However, if a third country transfer is described in the tables under section 4 above, we will transfer your personal data to Mölnlycke’s affiliates that are located or have business activities in a country outside the EU/EEA. In such cases, we are responsible for ensuring that the transfer is made in accordance with applicable data protection legislation before it occurs, e.g., by ensuring that the country in which the recipient is located ensures an adequate level of data protection according to the European Commission, or by ensuring appropriate safeguards based on the use of standard contractual clauses that the European Commission has adopted and other appropriate measures to safeguard your rights and freedoms.

You may access a list of the countries that the European Commission has decided provide an adequate level of data protection here.

You may access the European Commission’s standard contractual clauses at here.

You have the right to obtain a confirmation as to whether or not we process your personal data. If that is the case, you also have the right to receive copies of the personal data concerning you that we process as well as additional information about the processing, such as for what purposes the processing occurs, relevant categories of personal data and the recipients of such personal data.

You have the right to, without undue delay, have incorrect personal data about you rectified. You may also have the right to have incomplete personal data completed.

You have the right to request that we erase your personal data without undue delay in the following circumstances: (i) the personal data is no longer necessary in relation to the purposes for which they were collected or otherwise processed; (ii) you withdraw your consent on which the processing is based (if applicable) and there is no other legal ground for the processing; (iii) you object to our processing of personal data, and we do not have any overriding legitimate grounds for the processing; (iv) the processed personal data is unlawfully processed; or (v) the processed personal data has to be erased for compliance with legal obligations.

You have the right to restrict the processing of your personal data in the following circumstances: (i) you contest the accuracy of the personal data during a period enabling us to verify the accuracy of such data; (ii) the processing is unlawful, and you oppose erasure of the personal data and request restriction instead; (iii) the personal data is no longer needed for the purposes of the processing, but are necessary for you for the establishment, exercise or defence of legal claims; or (iv) you have objected to the processing of the personal data, pending the verification whether our legitimate grounds for our processing override your interests, rights and freedoms.

You have a right to object to our processing of your personal data when it is based on our or another party’s legitimate interest. If you object, we must demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms in order to be allowed to continue with our processing.