Privacy Policy
Last updated: 8 September 2026
1. Introduction
DeepScan Diagnostics Oy (“DeepScan,” “we,” “our” or “us”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose and safeguard personal data when you visit our websites, use our veterinary portal or other digital services, interact with us as a customer or business contact, or participate in our research and development activities.
DeepScan Diagnostics Oy
Business ID: 3287235-6
Elimäenkatu 17–19
00510 Helsinki, Finland
For the processing described in this Privacy Policy, DeepScan Diagnostics Oy generally acts as the data controller.
In some circumstances, particularly where a veterinary clinic or other customer submits personal data to our services and DeepScan processes that data solely on the customer’s instructions, the clinic or customer acts as the data controller and DeepScan acts as its data processor. In those circumstances, the relevant clinic’s or customer’s privacy notice applies to its processing of personal data.
This Privacy Policy applies to deepscandx.com, DeepScan’s veterinary portal and other DeepScan websites, portals and digital services that link to this Privacy Policy.
2. Personal Data We Collect
We process personal data relating to several different groups of individuals. The information we collect depends on how you interact with DeepScan.
2.1 Website Visitors, Enquiries and Marketing Contacts
When you visit our website or interact with us, we may collect information that you provide when you:
- contact us or submit an enquiry;
- subscribe to newsletters or other communications;
- request information about our services;
- register for webinars, events or other activities; or
- otherwise communicate with us.
This information may include:
- name;
- email address and telephone number;
- job title;
- clinic, company or organisation;
- information contained in your communications with us; and
- marketing preferences and consent records.
When you use our website, we may also collect technical information such as:
- IP address;
- browser and device information;
- operating system;
- pages viewed and interactions with our website;
- date and time of visits; and
- referring website or source.
Our use of cookies and similar technologies is described in our Cookie Policy.
2.2 Veterinary Clinics and Portal Users
When a veterinary clinic or other customer registers for and uses our services, including our veterinary portal, we may process:
- clinic or organisation name, address and contact information;
- names, job titles and business contact details of veterinarians and other users;
- user account and authentication information, including usernames and hashed passwords;
- account activity, access records and security logs;
- test orders and information associated with those orders;
- animal information submitted by the clinic, such as name, breed, age, sex and other relevant information;
- CFD® biomarker results, reports and related information;
- billing and transaction information where it relates to an identifiable individual; and
- correspondence, feedback and customer-support communications.
Information relating only to an animal is not, by itself, personal data under the GDPR. However, where animal or test information is linked to an identifiable owner, we treat the information relating to that owner as personal data in accordance with this Privacy Policy.
Where a clinic provides personal data to us solely for processing on its behalf, DeepScan acts as a data processor as described in Section 1.
2.3 Dog Owners Participating in Research and Development
In connection with our research and development activities, including sample collection programmes conducted with partner veterinary clinics, we may process:
- dog owner name and contact information;
- information identifying or describing the participating dog;
- sample information;
- CFD® results and other research data associated with the dog;
- information relevant to the research programme that you or the participating clinic provides to us;
- consent records; and
- communications relating to participation or research results.
Participation in our R&D programmes is voluntary. Where we rely on your consent, you may withdraw that consent at any time as described in Section 8.
2.4 Sources of Personal Data
We collect personal data:
- directly from you;
- from veterinary clinics and other customers using our services;
- automatically when you interact with our websites or digital services;
- from service providers acting on our behalf; and
- where appropriate and permitted by law, from publicly available professional sources or business contact databases.
If we receive your personal data from a veterinary clinic or another organisation, that organisation may separately act as a data controller for its use of your information.
3. How and Why We Use Personal Data
We process personal data only where we have a lawful basis for doing so.
| Purpose | Legal basis |
|---|---|
| Responding to enquiries and providing customer support | Our legitimate interests in responding to enquiries, supporting customers and operating our business; or performance of a contract where applicable |
| Creating, administering and securing veterinary portal accounts | Our legitimate interests in administering customer relationships and maintaining secure services; or performance of a contract where the individual is a party to that contract |
| Providing our services and delivering CFD® test results | Performance of a contract where applicable and our legitimate interests in providing services to our clinic customers |
| Managing customer relationships, billing and business administration | Performance of a contract, legitimate interests in managing our business, and compliance with legal obligations |
| Sending newsletters and communications that you have requested | Consent |
| Direct marketing to relevant professional and business contacts | Our legitimate interests in promoting our products and services where permitted by law; consent where consent is legally required |
| Operating, maintaining and securing our websites and services | Our legitimate interests in operating secure and reliable services |
| Website analytics and non-essential cookies or tracking technologies | Consent where required by applicable law |
| Conducting R&D sample collection programmes and communicating results to participating dog owners | Consent where we have asked you to participate on that basis |
| Developing and maintaining research datasets using identifiable or pseudonymised participant information | Consent or another applicable lawful basis communicated to the participant |
| Creating and using irreversibly anonymised research, animal and sample datasets | GDPR does not apply once information has been irreversibly anonymised so that an individual can no longer reasonably be identified |
| Preventing fraud, misuse and security incidents and protecting our legal rights | Our legitimate interests in protecting DeepScan, our customers and our services |
| Establishing, exercising or defending legal claims | Our legitimate interests and, where applicable, compliance with legal obligations |
| Complying with accounting, tax, regulatory and other legal obligations | Compliance with a legal obligation |
Where we rely on legitimate interests, we consider whether our interests are appropriate and proportionate in light of the individual’s rights and interests.
You have the right to object to processing based on legitimate interests in certain circumstances. You may object to processing for direct marketing purposes at any time.
4. Providing Personal Data
Some personal data is necessary for us to provide particular services.
For example, certain contact and account information is required to create and maintain a veterinary portal account, authenticate users, provide customer support and communicate about services. If required information is not provided, we may be unable to create an account, respond to a request or provide the relevant service.
Providing information for marketing purposes is voluntary.
Participation in our R&D programmes is also voluntary. Choosing not to participate will not affect your ability to obtain veterinary care or use services that are otherwise available to you.
5. How We Share Personal Data
We do not sell personal data. We may disclose personal data in the following circumstances.
Service Providers
We use third-party service providers to support functions such as:
- hosting and cloud infrastructure;
- IT and cybersecurity;
- laboratory and technical operations;
- logistics;
- communications;
- customer support;
- analytics;
- accounting and administration; and
- other services required to operate our business.
Where these providers process personal data on our behalf, they are required to process it in accordance with our instructions, applicable data protection law and appropriate contractual safeguards.
Some providers may act as independent data controllers for particular services. Where this is the case, they are responsible for their own processing of personal data.
Veterinary Clinics and Customers
Where necessary to provide our services, information may be made available to the veterinary clinic or other customer that ordered a test, submitted information or is otherwise responsible for the relevant customer relationship.
Research Partners
We may share anonymised animal, sample and research data with universities, scientific collaborators and other research partners.
Where research information remains personal data because it can be linked to an identifiable individual, including where information has been pseudonymised rather than anonymised, we will only disclose or otherwise process it where an appropriate lawful basis and safeguards are in place.
We do not disclose identifiable dog-owner information to independent research partners for their own research purposes without the owner’s consent or another applicable lawful basis.
Professional Advisers
We may disclose information where reasonably necessary to professional advisers such as lawyers, accountants, auditors and insurers.
Legal Requirements and Protection of Rights
We may disclose personal data where required by law, regulation, court order or other valid legal process, or where reasonably necessary to protect the rights, property or safety of DeepScan, our customers or others.
Corporate Transactions
Personal data may be disclosed where reasonably necessary in connection with a financing, investment, merger, acquisition, restructuring, sale of assets or similar corporate transaction. Appropriate confidentiality and data-protection safeguards will be used where required.
6. International Transfers
DeepScan is based in Finland and works with service providers, partners and customers internationally, including in the United States. Personal data may therefore be transferred to or accessed from countries outside the European Economic Area (“EEA”).
Where personal data is transferred outside the EEA, we use a lawful transfer mechanism as required by the GDPR.
For transfers to recipients in countries covered by an adequacy decision of the European Commission, we may rely on that adequacy decision.
For transfers to participating organisations in the United States, we may rely on the EU–US Data Privacy Framework where applicable.
Where no applicable adequacy decision exists, we may use safeguards such as the European Commission’s Standard Contractual Clauses (SCCs) together with supplementary safeguards where required.
You may contact us at support@deepscandx.com for further information about the safeguards used for international transfers of your personal data.
7. Data Retention
We retain personal data only for as long as reasonably necessary for the purposes for which it was collected and to comply with legal, accounting, regulatory and contractual obligations. The applicable retention period depends on the type of information and the purpose of processing.
Website Enquiries and Customer Communications
We retain enquiries and correspondence for as long as necessary to respond, manage the relevant relationship and deal with any reasonable follow-up, legal or business requirements.
Marketing Data
We retain marketing contact information while we have a relevant business relationship or marketing purpose and until you unsubscribe or object to direct marketing.
If you opt out of marketing, we may retain limited information on a suppression list where necessary to ensure that your preference continues to be respected.
Clinic Accounts and Portal Information
We retain account and customer information for the duration of the relevant customer relationship and thereafter where necessary for legal, regulatory, contractual, security, accounting or dispute-resolution purposes.
User access may be disabled or removed when it is no longer required.
Website and Security Information
Technical and security information is retained only for as long as reasonably necessary for website operation, security, troubleshooting, fraud prevention and related purposes.
Information about cookie lifetimes is provided in our Cookie Policy.
R&D Participant Information
Identifiable or pseudonymised participant information is retained for as long as necessary for the research purposes communicated to participants and in accordance with the applicable consent or other lawful basis.
Where you withdraw consent, we will stop processing based on that consent unless another lawful basis permits or requires continued retention. Withdrawal does not affect processing that took place lawfully before consent was withdrawn.
Information that has already been irreversibly anonymised cannot be linked back to an individual and is no longer personal data. Such anonymised research and animal data may therefore be retained and used for research, validation, statistical analysis and product development.
Legal and Statutory Records
Certain records may be retained for longer periods where required by accounting, tax, regulatory or other applicable laws, or where necessary to establish, exercise or defend legal claims.
8. Your Data Protection Rights
Where the GDPR applies to our processing of your personal data, you may have the following rights, subject to the conditions and exceptions provided by applicable law.
- Right of Access: You may request information about whether we process your personal data and obtain a copy of that data.
- Right to Rectification: You may ask us to correct inaccurate personal data or complete incomplete information.
- Right to Erasure: You may ask us to delete your personal data in circumstances where the GDPR provides a right to erasure.
- Right to Restrict Processing: You may ask us to restrict the processing of your personal data in certain circumstances.
- Right to Data Portability: Where applicable, you may request personal data that you have provided to us in a structured, commonly used and machine-readable format and ask that it be transferred to another controller.
- Right to Object: Where processing is based on our legitimate interests, you may have the right to object to that processing based on your particular situation. You have the right to object to the processing of your personal data for direct marketing at any time.
- Right to Withdraw Consent: Where we process personal data based on your consent, you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.
- Right to Lodge a Complaint: You have the right to lodge a complaint with a competent supervisory authority.
DeepScan’s lead supervisory authority in Finland is:
To exercise your rights, contact us at support@deepscandx.com.
We may need to verify your identity before fulfilling a request. We will respond in accordance with the time limits and requirements provided by applicable data-protection law.
If DeepScan processes your personal data solely as a processor on behalf of a veterinary clinic or another customer, we may direct your request to the relevant data controller or assist that controller in responding to your request.
9. Cookies and Similar Technologies
We use cookies and similar technologies to operate our website, maintain security, understand website usage and, where applicable, support analytics or marketing activities.
Cookies and technologies that are not strictly necessary are used only with consent where required by applicable law.
You can accept, reject or change your choices for non-essential cookies through the cookie settings available on our website.
For information about the technologies we use, their purposes, duration and relevant third parties, please see our Cookie Policy.
10. Automated Decision-Making
We do not use personal data to make decisions about individuals based solely on automated processing that produce legal effects or similarly significant effects within the meaning of the GDPR.
Our products and services may use automated technical or computational processes to analyse animal samples and produce animal diagnostic information. These processes do not constitute automated decision-making about an individual person with legal or similarly significant effects.
11. Data Security
We use appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.
These measures include, where appropriate:
- authenticated and controlled access to our systems;
- encryption and other technical safeguards;
- access management;
- security monitoring;
- contractual safeguards with service providers; and
- internal organisational and security procedures.
No method of electronic transmission or storage can be guaranteed to be completely secure. We therefore cannot guarantee absolute security, but we continuously assess and improve our safeguards as appropriate.
12. Third-Party Websites
Our websites and services may contain links to websites or services operated by third parties.
DeepScan is not responsible for the privacy practices of third-party websites or services. We encourage you to review their privacy notices before providing personal data.
13. Children's Privacy
Our websites, veterinary portal and services are not directed to children.
We do not knowingly collect personal data from children through our website or veterinary portal. If we become aware that personal data relating to a child has been collected in circumstances where it should not have been, we will take appropriate steps in accordance with applicable law.
14. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our services, processing activities or applicable legal requirements.
When we update the policy, we will publish the revised version and update the “Last updated” date.
Where a change materially affects how we process personal data, we will provide additional notice where appropriate, for example through our website, veterinary portal or by email.
15. Contact Us
If you have questions about this Privacy Policy, our processing of personal data or your data-protection rights, please contact:
DeepScan Diagnostics Oy
Business ID: 3287235-6
Elimäenkatu 17–19
00510 Helsinki, Finland
Email: support@deepscandx.com