European Applicant Privacy Notice

European Applicant Privacy Policy

Effective Date: March 18, 2025

SAGA Diagnostics US, Inc., located at 860 Aviation Parkway, Ste 300, Morrisville, NC 27560, and its affiliated companies in the United States and Europe, including SAGA Dx, Inc., SAGA Diagnostics AB, and SAGA Diagnostics UK, Ltd., (collectively “SAGA”) respect your right to privacy and are committed to adhering to applicable data protection laws.

This Applicant Privacy Notice (the “Notice”) describes the personal data collected by SAGA from employee applicants directly as well as the personal data we may collect about employee applicants during the application, recruitment, and hiring processes. Personal data refers to information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular applicant. Collected and stored personal data can appear in the form of:

Background Checks – such as such as criminal history, criminal records, driving citations, reference or background checks
Browsing Information – such as cookie information, IP address, website history
Contact Information – such as emergency contact details, home address, personal email, and phone numbers
Education & Skills – such as education & training history, educational degrees, grades, and languages
Employment Information – such as job application details, job title/role, previous work history, record of absence, salary/wage expectation, start date
Government Identifiers – such as driving license number, national identification number, national identity card details, passport number, and social security number
Personal Identification – such as citizenship status, date of birth, disability or specific conditions, full name, gender, marital status, military or veteran status, nationality, racial or ethnic origin, signature and unique identification numbers for HCPs
Professional Experience & Affiliations – such as professional memberships and qualifications/certifications
Social – such as social media accounts and contacts
Travel & Expenses – such as travel booking details and travel history

Purposes and Legal Basis for Processing Personal Data
SAGA processes the personal data of applicants for the following purposes:

The recruitment of Employees and Contractors: This process involves the recruitment of candidates to fill new or vacant positions with SAGA. During this process, resumes are collected and reviewed, candidates may be interviewed and assessed to determine qualifications, and offers of employment are extended to select candidates. We process this personal data on the basis that it’s necessary for establishing an employment contract with the respective candidate (pre-contractual steps).
Evaluation/Screens of Applicants: For select candidates SAGA will perform pre-employment screening verification of the applicant’s information and background. In certain cases, conducting these evaluations is necessary for determining if an applicant can participate in federal healthcare programs. We process this personal data on the basis of our legitimate interest as an employer.
Hiring and Onboarding of Employee and Contractors: SAGA uses personal data collected in the recruitment process to establish the contract, complete necessary onboarding documentation and create necessary accounts for the hired employee. We process this personal data on the basis that it’s necessary for entering into an employment contract with the relevant employee.

With Whom Do We Share Your Data?

We take care to allow your personal data to be accessed only by those who have a legitimate need to in order to perform their tasks and duties, and to third parties who have a legitimate purpose for accessing it.

When acting as a data controller, we may share your personal data with other employees, other SAGA group companies, contractors, consultants, and service providers who require the data to provide products and services to SAGA to establish, manage or terminate your employment with SAGA. Data controllers are those who collect the data in question and determine how it will be used.

For example, we engage third parties such as employee benefit plan providers and payroll support services. In some cases, these parties may also provide certain IT and data processing services to us so that we can operate our business.

When we share personal data with these parties for specific tasks, referred to as processors, we typically require that they use or disclose that personal data only as directed by SAGA and in a manner consistent with this Notice and applicable laws. We also enter contracts with these parties to make sure they respect the confidentiality of your personal data and have appropriate data security measures in place.

If we go through a corporate sale, merger, reorganization, dissolution or similar event, personal data we gather from you may be transferred in connection with such an event. Any acquirer or successor of SAGA may continue to use the data as described in this Notice provided that the acquirer or successor is bound by appropriate agreements or obligations and may only use or disclose your personal data in a manner consistent with the use and disclosure provisions of this notice, or unless you consent otherwise.

We may also disclose your personal data to a third party under the following circumstances:

if we in good faith believe we are compelled by any applicable law, regulation, legal process, or government authority;
where necessary to exercise, establish or defend legal rights, including to enforce our agreements and policies;
to protect SAGA’s rights or property;
in connection with regular reporting activities to other members of the SAGA corporate family;
to protect SAGA, our other customers, or the public from harm or illegal activities;
to respond to an emergency which we believe in good faith requires us to disclose data to prevent harm; or
with your consent, which you have the right to withdraw your consent at any time, such as website cookie tracking.

International Operations and Transfers Out of Your Home Jurisdiction

Your personal data may be collected, used, processed, stored, or disclosed by us and our service providers outside your home jurisdiction, including in the U.S., and in some cases, other countries. These countries may have data protection laws that are different from the laws of your country. SAGA only transfers personal data to another country, including within the SAGA corporate family, in accordance with applicable privacy laws, and provided there is adequate protection in place for the data.

How Do We Secure Your Data?

We use appropriate technical and organizational security measures to protect the security of your personal data both online and offline including the implementation of access controls, implementation of firewalls, network intrusion detection and use of anti-virus software. Please note that no system is completely secure.

How Do You Update Your Personal Data?

It is important that the information contained in our records is both accurate and up-to-date. We offer various self-help tools that will allow you to update certain of your personal data in our records. If your personal data changes, please use these self-help tools to update that data, where available, or let Human Resources (HR) know of those changes.

How Can You Request Access to Your Personal Data?

Please make this request to our HR department in writing, including email, at hr@sagadiagnostics.com. We may ask you for information to verify your identity and evaluate your right to access the personal data requested. You can also ask that we delete personal data that you believe is inaccurate or no longer relevant in this same way. Of course, we might need to refuse access to, or deletion of, personal information in certain cases, such as when providing access might infringe someone else’s privacy rights or impact our legal obligations.

What Other Rights Do You Have Over Your Personal Data?

You have the right to request access of an overview of your personal data, and under certain conditions, rectification and/or erasure of personal data. In addition, you may also have the right of restriction of processing concerning your personal data, the right to object to processing as well as the right to data portability.

For example, if we have collected and processed your personal data with your consent, then you have the right to withdraw your consent at any time. Withdrawing your consent will not affect the lawfulness of any processing we carried out prior to your withdrawal, nor will it affect processing of your personal data carried out in reliance on other lawful grounds other than consent.

How Long Do We Retain Your Personal Data?

We will keep your personal data for as long as is needed to carry out the purposes we’ve described above, or as otherwise required by law. Generally, this means we will keep your personal data until the end of your employment application process with us, plus a reasonable period after that where necessary to respond to any employment inquiries, deal with legal, tax, accounting, or administrative matters, or to provide you with ongoing pensions or other benefits.

For employee applicant personnel records, that retention period is 7 years after the applicant’s relationship with SAGA has ended.

Where we have no continuing legitimate business need to process your personal data, we will either delete or anonymize it or, if this is not possible (for example, because your personal data has been stored in backup archives), then we will securely store your personal data and isolate it from any further processing until deletion is possible.

Contact Details

If you have questions about this Statement, you can write to us at the following addresses:

Data Protection Officer (GDPR):

SAGA Diagnostics AB

Scheelevagen 2, MV406

223 81 Lund

Sweden

+46 73 301 72 42

SAGA Diagnostics, Inc.

Attn: Privacy Officer

860 Aviation Parkway, Ste 300

Morrisville, NC 27560