Privacy & Security

SmartSimple Software Inc. (SamrtSimple) will collect information on behalf of Calliditas Therapeutics AB (Calliditas, we) in order to simplify the administration of grants and other support for non-promotional activities (investigator initiated studies, independent medical education, patient interest groups, etc.). In order to be able to help Calliditas with that SmartSimple will process personal data on behalf of Calliditas as a processor.
In this Privacy Notice we will explain what types of personal data we will process, how and why we process the personal data, how we protect and disclose personal data, and the rights that you may have regarding our processing of your personal data.

How do we collect personal data?

Primarily, we collect personal data from you as a potential and actual grant recipient.

Types of personal data that we process

Categories of personal data: contact information (name, address, email, telephone number), type of organization, title or role of individual representatives (if any), bank details (for grant payments).

Contact information e.g., name, e-mail address, address and telephone number
Your role, e.g., title or role, type of organization
Bank information - bank details (for grant payments

Why are we processing personal data?

We process personal data for the following purposes:

To administer and manage the grant procedure.
To administer and manage communication with you.
To maintain records.
To comply with legal requirements.
To safeguard and exercise legal rights.

Legal grounds

The legal ground that supports the specific processing depends on the context of the processing.

Some of the personal data are processed because it is necessary for us administer and manage a current or expected agreement. Other information is processed because it is necessary due to a legitimate interest of ours, or because it is necessary because we have a legal obligation to process the information (e.g., accounting act, discrimination act, etc.). In some cases, consent is the legal ground supporting the processing.

Disclosure and transfer of personal data

Calliditas take adequate technical and organizational security measures to protect personal data from loss and unauthorized access. For instance, access to your personal data is limited to only those who need the data for the stated purpose.
For various reasons, Calliditas may transfer your personal data to third parties, e.g., to

SmartSimple acting as data processor.
Governmental authorities if needed to comply with legal obligation or authority decision.

We strive to process personal data within the legalslative boundries of your country/region. In cases where we, despite this, process personal data outside your country/region, we will ensure an adequate level of protection in accordance with applicable legislation.

Retention periods

Calliditas will only process the personal data as long as it is necessary for the respective purpose:

Some information will be processed as long as we have a business relationship and will be deleted when the business relationship has ended and when no rights and/or obligations remains due to such relationship.
Other information is processed for an extended period for us to comply with a legal obligation.

Your rights

You have the right to request a copy of the personal data that we process about you. However, there might be circumstances preventing certain information from being disclosed, e.g., due to provisions in another law, or if another person might be adversely affected by the disclosure.
If we process inaccurate or irrelevant personal data of yours, you have the right to contact us to get the information corrected. Under certain conditions, you also have the right to

object to the processing; and
request deletion of your personal data; and
request restriction of us processing your personal data; and
request your personal data to be transferred to you or another controller, in a commonly used, machine readable format.

To exercise any of the above rights, please contact us at info@calliditas.com.
If you believe that we process your personal data in violation of the General Data Protection Regulation, you should inform us as soon as possible by contacting us on the contact details above. You also have the right to submit a complaint to the Swedish supervisory authority “Integritetsskyddsmyndigheten”, for more information see www.imy.se.