Personal Data FAQ

AIVF acts as a data processor with respect to personal data of patients processed through our EMA platform, and which AIVF processes on behalf of our customers. We process this data strictly on behalf of and under the instructions of our customers, in accordance with the Data Processing Addendum (DPA) and other commercial agreements that we have with them. For additional information, AIVF’s dedicated Privacy Policy for the EMA Platform is available upon request.

AIVF acts as a data controller with respect to personal data that we collect for our own purposes, which includes personal data collected through our website visitors, contact details of our prospective and existing customers, and billing information of our customers and vendors. For more information on personal data that we process as the data controller please refer to our Privacy Policy.

As a data controller, we collect and process personal data of various data subjects – personal data about our users / customers / website visitors and those who interact with our promotions and marketing, personal data of prospective and existing business customers, personal data of our customers’ platform users (i.e., account administrators, Physicians, Clinicians, etc.), personal data of employees and service providers. You can read more about what types of personal data we process and how we process personal data in our Privacy Policy.

As a data processor, we process personal data strictly on behalf of and under the instructions of our customers – as part of the provision of our services and products. For additional information, AIVF’s dedicated Privacy Policy for the EMA Platform is available upon request.

AIVF processes personal data as a data controller as described in our Privacy Policy.

AIVF processes personal data on customers’ patients through the EMA Platform. The personal data collected with respect to our customers’ patients is determined by the customer. Such data is typically collected both directly from the customer (via the customer’s patient Electronic Medical Records) and directly from incubators used by the customer. Personal data collected may include customer-issued patient ID or other ID as determined by the customer, gender, date of birth or age. It may also include patient health information (e.g., age, height, weight), reproductive health history, and genetic or biometric data relating to embryos undergoing incubation.

For additional information, please review AIVF’s dedicated EMA Platform Privacy Notice.

AIVF will process personal data on customers’ patients as part of our services through the EMA Platform, in accordance with the Data Processing Addendum and other agreements we have in place with the customer, and in accordance with the customer’s reasonable instructions.

Generally, AIVF processes patient personal data in order to provide AI-driven automated and objective insights to augment embryo evaluations. AIVF’s proprietary EMA Platform offers customers a secure and user-friendly interface for performing such embryo evaluations and allows customers to provide more effective and informed IVF treatment for patients.

No. Though the EMA Platform allows for accurate and fully automated embryo evaluations, such evaluations only serve to assist our customers in the process of making key clinical decisions. The EMA Platform does not independently determine or recommend any clinical decisions, rather, the Platform makes each embryo evaluation available to the customer for review. Customers using the EMA Platform will likely take into account the score the EMA Platform gives to a particular embryo before the customer determines the next appropriate steps. For example, an embryo that receives a high EMA Score, demonstrates a 70% probability for a successful pregnancy. Nevertheless, it is the customer, not the EMA Platform, that is responsible for any “decision-making,” including the decision of which embryo(s) are used in ensuing medical procedures.

AIVF’s global privacy program is designed to comply with the most comprehensive and advanced data protection regulation in the world, the EU General Data Protection Regulation (GDPR). Meanwhile, AIVF continues to look for ways to enhance its data protection and privacy posture, and consistently adapts its privacy program as necessary to meet current regulatory standards.

For these purposes, AIVF has also appointed leading privacy consultancy PrivacyTeam Ltd. as its Data Protection Officer, for monitoring and advising on AIVF’s ongoing privacy compliance and serving as a point of contact on privacy matters for data subjects and supervisory authorities. AIVF’s Data Protection Officer may be reached at privacy@aivf.co.

As a Business Associate under HIPAA, AIVF provides services to Covered Entities in accordance with the relevant Business Associate Agreement (BAA) and only uses and discloses HIPAA protected health information for the purposes for which it was engaged by the Covered Entity (or as otherwise permitted in the applicable BAA). In accordance with statutory and contractual requirements, AIVF’s Privacy and Security programs were designed to comply with HIPAA’s Security and Breach Notification Rules.

AIVF offers our own Data Processing Addendum (DPA) in which we commit to process our customers’ personal data and perform our duties as a data processor in accordance with the GDPR, as well as other applicable data protection regulations. AIVF similarly offers a Business Associate Agreement (BAA) in which we commit to processing protected health information (PHI) in accordance with our obligations under HIPAA. You can review our DPA or our BAA upon request.

AIVF has appointed leading privacy consultancy PrivacyTeam Ltd. as its Data Protection Officer, for monitoring and advising on our ongoing Privacy compliance and serving as a point of contact on Privacy matters for data subjects and supervisory authorities. Our Data Protection Officer may be reached at privacy@aivf.co.

Yes, we use sub-processors in order to provide our services. Before engaging any third-party sub-processor, we evaluate their privacy, security, and confidentiality practices and execute an agreement implementing the applicable requirements under privacy regulations and that are no less onerous than the requirements that exist in the DPAs (or BAAs) that we have with our customers.

A list of our subprocessors is available upon request.

AIVF stores customer data in Israel, the EU/UK and in the United States. AIVF generally stores data according to the region of the customer. If the customer is located in the EU or UK, data will be stored in these regions. If a customer is located in the United States, data will be stored in the United States.

In the event that data is transferred from the European Economic Area to the United States, a legally accepted transfer mechanism will be used, such as the EU Standard Contractual Clauses (SCCs) approved by the European Commission in 2021, with supplemental clauses approved by the UK Information Commissioner’s Office and the Swiss Federal Data Protection and Information Commissioner, to transfer personal data from the EEA/UK/Switzerland to the US. These include additional safeguards laid out and enforced both in the SCCs themselves and in AIVF’s DPA to ensure that the data is protected, kept confidential, and data subject rights are enforced to the same standards afforded under the GDPR in the EEA and Switzerland and under the UK GDPR in the UK.

AIVF is committed to providing customers with a highly secure and reliable environment for their data. We have therefore developed a security model that covers all aspects of our systems, including encryption of data in transit and at rest, access restrictions, and firewalls.

All AIVF data collected on behalf of customers who opt for our cloud-based product and services are located in AWS’s EU/UK or USA-based data centers (depending on the location of the respective customer), where there are both DRP and BCP plans.
Additionally, AIVF’s EMA Platform holds a CE Mark and is ISO13485, ISO27001 and ISO27799 certified.

A more detailed description of our security policies is available upon request.

AIVF has an internal procedure to respond to data subject requests (e.g., to receive a copy of any personal data that AIVF holds on that data subject in our systems, to correct any inaccuracies in the data we hold, or to have it deleted, etc.) in a timely manner and subject to applicable law.

If AIVF is the processor of the personal data (i.e., processes it on behalf of a certain customer), then AIVF will refer the request to the appropriate customer (where we can link the request to that customer) and/or inform the data subject that we are the data processors and that in order to exercise their data rights they must approach the relevant customer, who is the controller of the data in question. We will then act strictly in accordance with the customer’s instructions, subject to any superseding regulations.

AIVF uses AWS’s cloud storage services in Frankfurt, Germany to store customer data. In this engagement, the storage of the data in the AWS cloud is subject to AIVF’s Data Processing Agreement with AWS.