DSGVO

DSGVO stands for Datenschutz-Grundverordnung, the German name for the EU General Data Protection Regulation. Health data belongs to a special category under it, which means the conditions for handling a blood result are narrower than the conditions for a name and an email address.

A diagnostics supplier that receives orders, samples and results from you processes that data on your behalf, so the relationship between the two companies is written into a contract rather than assumed. The German name for that contract is Auftragsverarbeitungsvertrag, or AVV, the processor agreement between the company that decides the purpose and the company doing the processing for it. It names the purpose, the categories of data, the storage period and the technical measures, and it lists the sub-processors the supplier uses. Aniva includes an AVV as standard and processes EU-native on infrastructure hosted in Germany.

The checkable parts of a supplier conversation are short, so ask for them early.

• Ask where the data is held, with the country and the provider named for each system.
• Ask for the current list of sub-processors and how you are told about a change to it.
• Ask which fields about your customer the supplier receives, because a supplier that needs fewer fields is easier to review.
• Ask how long results are held and what happens to them after a contract ends.
• Ask who inside the supplier company can read a result and how that access is recorded.

None of this replaces your own data protection advice, because what applies to you depends on your product and on your role in the processing. The documents above are the part a buyer can read and compare, which is why they belong in the first supplier call rather than the last one.

In this glossary, LIMS covers the laboratory system that holds the sample record, while ISO 27001 covers how a supplier organises information security and Partner-Portal covers who inside your team can read a result.