Privacy & Cookie Policy
Last updated: July 2026
1. Who we are and what this notice covers
At Abacus Medicine A/S (“Abacus Medicine”, “we”, “us”), we take your privacy and the security of your information seriously. This Privacy & Cookie Notice explains how we collect and use personal data in connection with the website you are visiting and applies to the following categories of processing:
- website visitors and server logs;
- business communication;
- pharmacovigilance;
- newsletter subscribers;
- training of healthcare professionals;
- and cookies and similar technologies.
Abacus Medicine A/S and its subsidaries act as joint controllers for the processing described in this notice. Under our joint controllership arrangement pursuant to Article 26 GDPR, Abacus Medicine A/S is responsible for operating the website, maintaining this notice and handling data subject requests, and local subsidiaries are responsible for local business communication and relationship management. A summary of the essence of the arrangement is available on request from privacy@abacusmedicine.com. You may exercise your rights under the GDPR in respect of and against each of the controllers.
2. Website visitors and server logs
The data we collect
When you visit our website, our web servers automatically record technical data: your IP address, browser type and version, operating system, the pages you visit, date and time of access, statistics, and the referring website.
Purpose and legal basis
We process this data to deliver the website, to ensure network and information security and to detect and defend against attacks and misuse. The legal basis is Article 6(1)(f) GDPR and our legitimate interest in operating a secure and functioning website.
Retention
Server log data is deleted or irreversibly anonymised no later than 14 days after collection, unless a specific security incident requires longer retention.
3. Communication
The data we collect
- Name, email-address, telephone number, job title, and employer.
- The information you choose to provide to us in your enquiry or correspondance.
- Statistics
Purpose and legal basis
Your personal data is used for general business communication. The legal basis is Article 6(1)(f) GDPR and our legitimate interest in communicating and trading with our business partners and other stakeholders.
Recipients
Your personal data will be shared with our service providers and data processors in order to make use of their services. All data processors are bound by our instructions and will only process your personal data in accordance with this notice. Your personal data may also be shared with external advisors as part of our internal review procedures to address our compliance with legal obligations; all external advisors are bound by confidentiality obligations.
Retention
We keep correspondence for as long as necessary for the purpose of the communication, unless a longer period is required to comply with a legal obligation or to establish, exercise or defend legal claims.
4. Pharmacovigilance
The data we collect
When a pharmacovigilance report is made, we collect the information necessary to fulfil our legal obligations relating to pharmacovigilance. This may include:
- Patient initials, gender, and date of birth.
- A description of the adverse reaction and related health information.
- Contact details of the reporter.
Purpose and legal basis
- Complying with our legal obligations to collect, assess and report adverse reactions – Article 6(1)(c) GDPR.
- Detecting and preventing adverse effects and other medicine-related problems for reasons of public health – Article 9(2)(i) GDPR.
- Transmission of the report to the marketing authorisation holder or manufacturer based on your consent – Article 6(1)(a) GDPR.
Recipients
We may be legally obliged to share your personal data with independent data controllers, such as public health authorities and the product’s marketing authorisation holder or manufacturer.
Your personal data will be shared with our service providers and data processors in order to make use of their services. All data processors are bound by our instructions and will only process your personal data in accordance with this notice. Your personal data may also be shared with external advisors as part of our internal review procedures to address our compliance with legal obligations; all external advisors are bound by confidentiality obligations.
Retention
Pharmacovigilance records are kept for as long as the product is authorised and for at least 10 years after the marketing authorisation has ceased to exist, in line with EU good pharmacovigilance practices.
5. Newsletter subscribers
This section explains how Abacus Medicine collects and uses your personal data when you subscribe to our newsletter.
The data we collect
- Ordinary personal data: name, e-mail address, company.
- Engagement data: whether and when the newsletter is opened, link clicks, IP address and approximate location, collected via tracking pixels in the newsletter.
Purpose and legal basis
We process this data to provide the newsletter service and to measure and improve its relevance. The legal basis is your consent, Article 6(1)(a) GDPR. You can withdraw your consent at any time via the “Unsubscribe” link in each newsletter or via the website; withdrawal does not affect processing carried out before withdrawal.
Recipients and transfers
Your personal data will be shared with our service providers and data processors in order to make use of their services. All data processors are bound by our instructions and will only process your personal data in accordance with this notice. Your personal data may also be shared with external advisors as part of our internal review procedures to address our compliance with legal obligations; all external advisors are bound by confidentiality obligations.
Retention
We process your personal data for as long as you are subscribed. After you unsubscribe, we retain proof of your earlier consent and of your withdrawal for up to 2 years to document compliance.
6. Training of healthcare professionals
This section applies when you register for our e-learning programme on the correct and safe use of our medicinal product Cardioplexol (the “Training”). The Training is provided free of charge, is directed exclusively at healthcare professionals acting in their professional capacity, and concludes with a certificate of completion.
The data we collect
- Identity and contact data: First Name, Last Name, Email Address, Phone Number, Language, Country.
- Professional data: Academic Title, Clinic/Hospital, Clinical Experience: Years of Experience as a Cardiac Surgeon, Clinical Experience: Approximate Number of Operations Performed.
- Account data: username, password (hashed), account settings.
- Learning data: modules accessed, progress, assessment attempts and results, date of completion, and certificates issued (name, course, date, certificate number).
- Technical data: log-in timestamps, device and browser information.
The Training does not involve the processing of patient data. Any case examples used in the Training are fictitious or fully anonymised.
Purpose and legal basis
| Purpose | Description | Legal basis (GDPR) |
|---|---|---|
|
Registration and account management |
Creating and administering your account, providing access to the platform and communicating with you about your enrolment. |
Art. 6(1)(b) — performance of the training agreement with you. |
|
Verification of professional status |
Confirming that access to product-related training content is limited to healthcare professionals, as required or expected under medicines-advertising law. |
Art. 6(1)(c) where verification is legally required; otherwise Art. 6(1)(f) — our legitimate interest in ensuring that product-related material is made available only to healthcare professionals, in line with Directive 2001/83/EC and national law. |
|
Course delivery and certification |
Delivering modules, tracking progress, administering assessments, issuing certificates and documenting completion — including, where the Training forms part of risk-minimisation measures agreed with competent authorities, maintaining auditable training records. |
Art. 6(1)(b); Art. 6(1)(c) or 6(1)(f) for documentation and audit records. |
|
Safety and quality follow-up |
Informing you of updates to the Training or to safety-relevant product information, and improving the quality of the Training. |
Art. 6(1)(f) — legitimate interest in the safe and correct use of our product. Any marketing beyond this requires consent under applicable e-marketing rules. |
Recipients
- [E-learning platform provider], acting as our processor, hosting in [country].
- Abacus Medicine group companies involved in the Training, including [Swiss Cardio Technologies AG as marketing authorisation holder — verify per market] and [local distribution partners where they organise the Training].
- Competent authorities (e.g. national medicines agencies, Swissmedic, or EMA in the context of inspections), where we are legally required to demonstrate that training has been provided and completed.
Retention
Training and certification records are retained for as long as the product is on the market and for 10 years thereafter. Account data is deleted upon your request, unless the record must be kept as part of the training documentation described above.
7. Cookies and similar technologies
Scope and purpose
When you visit our website, cookies and similar technologies are stored on or read from your device in accordance with the preferences you set in our consent management tool. Cookies are small text files that enable us to collect data about the use of our website; their use may involve processing of personal data such as your IP address.
We use cookies to collect and process information about you for the following purposes:
- To support the website’s functionality in order to provide you with a better user experience. To perform statistical analyses of your use of the website in order to improve your and other visitor’s user experience.
- To show you targeted marketing, in accordance with your preferences.
Legal basis
Non-essential cookies are set only with your consent, in accordance with the national rules implementing Article 5(3) of the ePrivacy Directive, and any associated processing of personal data is based on Article 6(1)(a) GDPR.
Strictly necessary cookies are exempt from consent; the associated processing of personal data is based on Article 6(1)(f) GDPR and our legitimate interest in providing a functioning website while limiting the processing of your data.
You can change or withdraw your consent at any time via the cookie settings link/icon on the website. If you do not consent, some functions of the website may be limited. You can also configure your browser to block or delete cookies; note that deleting cookies also deletes any opt-out cookie, which must then be set again.
Recipients and transfers
With your consent, personal data collected via cookies is processed by our data processors: Google Analytics 4.
The specific cookies used on this website are listed in Annex A, which is generated and kept up to date by our consent management platform.
The cookies used
Strictly necessary
Strictly necessary cookies help make a website navigable by activating basic functions such as page navigation and access to secure website areas. Without these cookies, the website would not be able to work properly. These cookies have a legitimate purpose and are not optional.
Data Processor | Cookie name | Expiration | Purpose |
|---|---|---|---|
Cookie Information
| CookieInformationConsent | 1 year | Supports the website´s technical functions. |
PHP | PHPSESSID | Session expires when browser is closed. | Third-party cookie. Required for the website to perform properly. |
Functional
Functional cookies make it possible to save information that changes the way the website appears or acts, for instance, your preferred language or region. These cookies are optional and require your consent.
Data Processor | Cookie name | Expiration | Purpose |
|---|---|---|---|
There are currently no functional cookies on the website. |
Statistical
Statistical cookies help the website owner understand how visitors interact with the website by collecting and reporting information. These cookies are optional and require your consent.
Data Processor | Cookie name | Expiration | Purpose |
|---|---|---|---|
Google Analytics
| _gid | A day | Collects information about the users, how they accessed the website and their activity on the website, for instance an IP-address, for analytics and reporting purposes. |
Google Analytics
| _ga | 2 years | Collects information about the users in order to distinguish between visitors to the website. |
Google Analytics
| _gat _gtag | A few seconds | Collects information about the users and their activity on the website, for instance an IP-address, for analytics and reporting purposes. |
Matomo | _pk_id | 13 months | Used to store a few details about the user such as the unique ID to recognize returning visitors. |
Matomo | _pk_ses | 30 minutes | Short lived cookie used to temporarily store data for the visit, such as a unique session ID. The cookie tracks the time of the visit for the user, time of the previous visit for the user, and number of visits for the user. |
Mouseflow | mf_[website-id] | Session | A cookie for identifying the current session on a website. The cookie contains information about the current session but does not contain any information that can identify the visitor. This cookie is deleted when the session ends, meaning when the user leaves the website.
The use of Mouseflow may include the use of heatmaps and session recordings, which track interactions like clicks, mouse movements, scrolls, form interaction and page changes. These interactions can afterwards be replayed in a video or visualized in a heatmap in order to find out what visitors are really looking for and how they get there. |
Mouseflow | mf_user | 90 days | A cookie for checking if the user is new or returning. This cookie establishes whether the user is a returning or first-time visitor. This is done simply by a yes/no toggle and no further information about the user is stored. |
Marketing
Marketing cookies are used to track visitors across websites. The intention is to display ads that are relevant and interesting to the individual user and thus more valuable for publishers and third-party advertisers. These cookies are optional and require your consent.
Data Processor | Cookie name | Expiration | Purpose |
|---|---|---|---|
Leadfeeder | _lfa | 2 years | The cookie registers data such as IP-addresses, owner of the IP address, time spent on the website and page requests for the visit, and stores and tracks audience reach. |
| _gcl_au | 3 months | Used by Google for experimenting with advertisement efficiency across websites using their services. |
Google Marketing Platform doubleclick.net | test_cookie | 15 minutes | Third-party cookie. Used for online marketing by collecting information about the users and their activity on the website. The information is used to target advertising to the user across different channels and devices. |
Google Marketing Platform doubleclick.net | IDE | 1 year | Third-party cookie. Used for online marketing by collecting information about the users and their activity on the website. The information is used to target advertising to the user across different channels and devices. |
8. International transfers
Where personal data is transferred to a country outside the EU/EEA that does not benefit from an adequacy decision, we rely on appropriate safeguards under Article 46 GDPR — in particular the European Commission’s Standard Contractual Clauses (2021/914/EU) supplemented, where required, by a transfer impact assessment and additional measures.
9. Your rights
Subject to the conditions of the applicable law, you have the right to:
- access the personal data we process about you;
- have inaccurate or incomplete data rectified;
- have your personal data erased (in certain circumstances);
- restrict our processing of your personal data (in certain circumstances);
- object to processing based on legitimate interests, and object at any time to processing for direct marketing;
- receive the data you have provided to us in a structured, commonly used, machine-readable format (data portability); and
- withdraw any consent at any time, without affecting the lawfulness of processing before withdrawal.
To exercise your rights, contact privacy@abacusmedicine.com.
10. Complaints
If you are dissatisfied with how we process your personal data, we encourage you to contact us first at privacy@abacusmedicine.com so that we can address your concern.
You also have the right to lodge a complaint with a supervisory authority, in particular in the country of your residence or place of work.
11. Changes to this notice
We may update this notice from time to time, for example to reflect changes in our processing activities or in the law. The current version, with its date, is always available on this page. Material changes will be highlighted on the website.
12. Contact
Abacus Medicine A/S
Kalvebod Brygge 35
1560 Copenhagen V
Denmark
Telephone: +45 70 22 02 12
E-Mail: privacy@abacusmedicine.com