Skip to content

Privacy Notice

Last Updated September 28, 2026.

This privacy notice addresses the processing of personal data by MedEnvoy Global B.V. (“MedEnvoy”, “we”, “us” and “our”). MedEnvoy Global B.V. acts as a controller in relation to the processing of personal data described in this privacy notice.

MedEnvoy has offices in the European Union, United Kingdom, Mexico, United States, Australia, New Zealand and Switzerland. This privacy notice is limited to the processing of personal data by MedEnvoy.

 

Definitions

In this privacy notice, we will use the following terminology:        

personal data:               any information that can directly or indirectly identify you.

controller:                    the natural or legal party that determines the means and purposes of the processing.

processing:                   any action with personal data, including but not limited to storage thereof.

purpose:                       the reason why personal data is processed.

GDPR:                         General Data Protection Regulation (Regulation (EU) 2016/679).

Processing Activities

MedEnvoy processes personal data for the purposes described hereinafter. In relation to these purposes, MedEnvoy determines means and purposes (the reason and form of the processing activities). Because of this, MedEnvoy qualifies as the controller. The GDPR only permits processing activities if the controller can apply a legal basis, specified in the GDPR, for each processing purpose. Under the GDPR, MedEnvoy is required to inform you about its processing of your personal data.

Please note that we do not only process personal data that we received from yourself, but that we might also process personal data of yourself that we received via a colleague of yours, via the manufacturer or another economic operator whose device you handle or use, or via other entities within the MedEnvoy Group.  

Discovery Calls

(legal basis: consent (article 6(1)(a) GDPR) and legitimate interest (article 6(1)(f) GDPR))

If you reach out to us via our website www.medenvoyglobal.com to plan a discovery call, we will process your contact and identification details such as your name, and email address. We process such personal data based on your consent and will retain this until you repeal your consent or decide to not pursue a proposal.       

If your organization becomes a customer of MedEnvoy after the discovery call, we will continue processing your data obtained for the discovery call based on our legitimate interest to have a business relationship with our customers. We will retain personal data processed for this purpose for a maximum of 10 or 15 (in case of implantable devices) years after our collaboration ends, refer to the section on our legal obligation.

Completing our business development process

(legal basis: legitimate interest (article 6(1)(f) GDPR))    

We can only provide our services to our customers after completion of the business development process. Communication between us and our (prospective) customer is essential in this process. If you are a (prospective) customer or acting on its behalf, we will process your contact and identification details such as your name, job title, email address, phone number and signature.   
           
We process these personal data based on our legitimate interest to set up a business relationship with our customers.

We will retain personal data processed for this purpose for a maximum of 5 years after the business development process has ended, unless we need to retain such any longer to comply with our legal obligations. 

Execution of an agreement with our customers

(legal basis: legitimate interest (article 6(1)(f) GDPR))    

To execute an agreement with our customers, we process contact and identification details such as name, job title, email address, phone number and signature. We process such personal data of our customers or those acting on their behalf. We will also process log-in data of our customers, or those acting on their behalf, to access our systems.     

To perform our tasks under an agreement with our customers, we may also process personal data of third parties that are involved with our customers’ devices, such as importers, distributors, authorized representatives, third-party logistic providers, or those acting on their behalf. Such personal data concerns contact and identification details such as name, job title, email address, phone number and signatures.  

We process these personal data based on our legitimate interest to communicate about the execution of, and to fulfil our obligations under, an agreement between our customers and us.

We will retain personal data processed for this purpose for a maximum 10 or 15 (in case of implantable devices) years after our collaboration ends, refer to the section on our legal obligation.

Fulfilling a legal obligation imposed on MedEnvoy

(legal basis: legal obligation (article 6(1)(c) GDPR))       

In the performance of our authorized representative, and importer services, we are legally obliged under article 11,12 and 13 of Regulation (EU) 2017/746 (“MDR”) and Regulation (EU) 2017/746 (“IVDR”) to process certain personal data. This includes personal data contained in technical documentation, requests from competent authorities, and complaints and reports from healthcare professionals, patients and users. Such personal data usually concerns contact and identification data such as name, gender, job title, email address, phone number and signatures. Where we receive complaints from patients via healthcare professionals or from these patients directly, we will ask the sender to resend the compliant with all identifying information linking back to the original patient removed. The original message will be destroyed and the anonymized copy will be forwarded to the appropriate stakeholder to capture proof of compliance with forwarding regulations, as per QSP 4.2-5 Control of Records.

We will retain personal data processed under our legal obligations under the MDR and IVDR for a maximum of a year after our collaboration with the respective customer ends, unless we are obliged to keep the personal data any longer under article 11(3)(b), and/or article 13(9) MDR and IVDR. These articles requires us to keep a copy of certain device-related documentation for a period of at least 10 years after the last device covered by its EU declaration of conformity has been placed on the market, and at least 15 years in case of implantable devices.

In case of a change of authorised representative, we shall continue to process personal data obtained in our role as (outgoing) authorised representative for the period stated in the arrangement for a change of authorized representative as referred to in article 12 MDR and IVDR, based on article 12(d) MDR and IVDR

Following tax legislation that is applicable to us, we are obliged to keep a financial administration. We will retain personal data contained in our financial administration information for seven years after the book year in which the respective work was completed in accordance with our legal administration obligation.

Our legal obligations can be found in the following Dutch legislation:

Algemene wet inzake rijksbelastingen

Continuation of our (global) business

(legal basis: legitimate interest (article 6(1)(f) GDPR))    

Depending on the needs of (prospective) customers, we may exchange data with other entities within the MedEnvoy Group. Having contact with employees or contractors of such other entities means that we will also process their personal data. This concerns contact and identification data such as name, job title, email address and phone number. To be able to run our business, we also process contact and identification details of our suppliers. We furthermore process contact details, the cv, and other personal information (if any) shared with us by prospective employees.        

Our legitimate interest in this case concerns our interest to continue our (global) business and collaborations.

We will retain the personal data of employees or contractors of other entities within the MedEnvoy Group as long as relevant for a specific (prospective) customer dossier in accordance with this privacy notice. We will retain the personal data of our suppliers for a maximum of a year after our collaboration with such supplier ends, unless we need to retain the personal data any longer to comply with our legal obligations. We delete personal data of prospective employees at the latest4 weeks after termination of the application procedure. In case you become an employee (or contractor) of MedEnvoy, we will provide you with our privacy notice for MedEnvoy employees and contractors.

Provision of our newsletter

(legal basis: consent (article 6(1)(a) GDPR))      

If you sign up for our newsletter via our website www.medenvoyglobal.com, we will process your email address to be able to respond to your request. We will process your email address based on your consent and retain your email address for the time you stay subscribed to our newsletter. If you are already a customer of MedEnvoy, we are permitted to add your email address to our newsletter list based on our legitimate interest to inform you about relevant legal developments concerning (in-vitro) medical devices and our related services. You can easily unsubscribe via a link provided in our newsletter. 

Comments via our website

(legal basis: legitimate interest (article 6(1)(f) GDPR))    

If you leave a comment at our website www.medenvoyglobal.com, we will process your email address and name as included in the comment form based on our legitimate interest to have a discourse about a post on our website. We will retain the personal data processed for this purpose until you delete your comment or until we delete our post from our website.        

Legal proceedings

(legal basis: legitimate interest (article 6(1)(f) GDPR))    

While we do not expect this to take place, we can use the personal data referred to in this privacy notice in relation to legal proceedings between yourself and us. Any processing that we undertake will include at a minimum your name and contact details as well as any information necessary for the proceedings.

In such case, we process your personal data based on our legitimate interest to defend our rights. We will process the personal data for this purpose until the matter between you and us has been settled in final instance and any retention period under our insurance has similarly lapsed.

Recipients personal data

In the execution of our activities, we involve service providers that process personal data on our behalf, such as ICT service providers. If you would like to receive a list of service providers engaged by us to process personal data on our behalf, please let us know and we will provide an up-to-date list. These service providers are processors on our behalf and are subject to a processor agreement with us.

We may, as well, upon reasonable request, share personal data with parties that act as independent controllers of the data involved. We may share your personal data with the following categories of independent data controllers:      

  • economic operators involved in the supply chain of our customers’ devices
  • users of our customers’ devices
  • our external advisors such as accountants and lawyers
  • judicial authorities, administrative bodies and competent and supervisory authorities.

Transfers

Depending on the customer on whose behalf we provide services, we can transfer personal data concerning you to countries or international organizations outside the European Economic Area (EEA). We may for example send your personal data back to you if you are based outside of the EEA, share your personal data with MedEnvoy Group entities based outside of the EEA, or transfer your data to make use of ICT services outside of the EEA. We will only transfer personal data concerning you to the countries listed below (if at all). We will take the appropriate measures approved by the European Commission to ensure that your data is processed in a secure and lawful manner.

The list of countries that have implemented an adequate level of data protection, as recognized by the European commission can be found here: Data protection adequacy for non-EU countries. 

For the transfer of personal data to other countries or to commercial organizations in the United States that are not participating in the EU-US Data Privacy Framework, we have entered into a standard contract as set out by the European Commission, supplemented with additional measures (if necessary) in order to ensure an appropriate level of data protection. You can request a copy of these standard contractual clauses at privacy@medenvoyglobal.com 

In case there is no adequacy decision for the third country to which your personal data may be transferred and we have not (yet) entered into a contract with the recipient of the personal data outside of the EEA, we only transfer your personal data after obtaining your explicit consent for such transfer. You should be aware that the transfer of personal data to such third country brings possible risks arising from the absence of adequate protection in the respective third country and the absence of appropriate safeguards. There might not be a supervisory authority and/or data processing principles and/or data subject rights might not be provided for in the third country. You are never obliged to give your consent for such transfer.

Data subject rights

The GDPR gives data subject rights. We fully support this and will hereinafter briefly inform you about these rights. If you have more detailed questions or wish to exercise your rights under the GDPR, please do not hesitate to contact us at privacy@medenvoyglobal.com

You have the following rights under the GDPR:

  1. The right to be informed

Under the GDPR you have the right to be informed. We fulfil this obligation primarily via this privacy notice but would be happy to inform you in an additional manner.

  1. The right of access

You have the right to obtain information about personal data that we hold concerning you and to receive a copy thereof.

  1. The right to rectify any incorrect personal data

You have the right to amend any personal data concerning you held by MedEnvoy that is incorrect or incomplete.

  1. The right to withdraw consent

Where the processing is based on your consent, you have the right to withdraw your consent at any time. Withdrawing your consent will not impact the lawfulness of any processing based on that consent prior to the withdrawal.

Please note that if we also process your personal data for another purpose subject to another legal basis, we are permitted to continue the processing of the personal data for that other purpose.

  1. The right of erasure

You have the right to request that we delete personal data concerning you if:

a. you feel that the processing is no longer necessary in relation to the processing purposes described in the foregoing;

b. you withdraw your consent;

c. we have no rights to further process your personal data after you exercised your right to object (see section 7);

d. the personal data have been unlawfully processed; or

e. deletion is required in light of a legal obligation that we are subject to.

  1. The right to restrict the processing

You have the right to request restricting of personal data concerning you when:

a. you contest the accuracy of the personal data;

b. the processing is unlawful, but you do not wish us to delete the personal data;

c. you require the personal data for the establishment, exercise or defence of a legal claim in a situation where we have no further purpose for the processing; or we are verifying whether we can comply with your objection to the processing.

  1. The right to object

You have the right to object against processing where such processing is based on our legitimate interest. Where you object to such processing, we will no longer process the personal data subject to that legal basis, except if we can demonstrate compelling legal grounds for the processing which override your interests and rights and freedoms or where the processing is necessary for the establishment, exercise or defence of legal claims.

  1. The right to data portability

You have the right to have personal data that you have provided to us transferred to another party at your request.

Profiling

We do not use your personal data for automated decision making nor for profiling.

Necessity of provision of personal data

The processing of your contact and identification details is necessary if you wish to use our services. If you are the only signatory of your organization, we cannot enter into an agreement with your organization without the provision of such data. In the provision of our services, it may be necessary that we process your personal data in order to fulfil our contractual and statutory requirements. The foregoing does not apply where we have engaged your employer for the processing of personal data.

Complaints

You always have the right to lodge a complaint with a supervisory authority if you have concerns about our handling of personal data concerning you. For the Netherlands, the Autoriteit Persoonsgegevens acts as the supervisory authority.

We would however be grateful if you could contact us to discuss your concerns prior to contacting the supervisory authority and will strive to address your concerns in an adequate manner.

Contact Us

MedEnvoy can be reached at:   

Quality Assurance

Prinses Margrietplantsoen 33    
Kamer 123
2595 AM ‘s-Gravenhage
Netherlands

Or by phone at: +31 70 326 21 48 

Privacy matters: privacy@medenvoyglobal.com