APPROVAL:

Author : Kim Rochat, 2026-09-04
Approver : Paul Bradfield, 2026-09-04

A. Introduction

‍

This document provides the content of our Privacy Policy which is published on our website at www.messenflow.com.

The content in the section B below is to be inserted in the privacy policy web page at https://www.mesenflow.com/privaty-policy. On this page the version indicated to the public shall be the date of release of this document.

B. Privacy Policy

‍

MesenFlow Technologies Sàrl ("MesenFlow", "we", "our" or "us") respects your privacy and is committed to protecting the personal data entrusted to us. This Privacy Policy explains what personal data we process, why and on what basis we process it, who receives it, how long we keep it and what rights you have. It applies to visitors of our website, to our customers, research partners and suppliers, to job applicants and to the research activities we sponsor or take part in.

We process personal data in accordance with the Swiss Federal Act on Data Protection (FADP) and, where it applies to our activities, the EU General Data Protection Regulation (GDPR). Where this Policy refers to articles of the GDPR, these references apply to processing that falls within the scope of the GDPR.

‍

1. Who is responsible for your data

The controller responsible for the processing described in this Policy is:

MesenFlow Technologies Sàrl
Avenue de la Roseraie 64, CH 1205 Geneva
E-mail: contact@mesenflow.com

MesenFlow is a small company and is not required to appoint a data protection officer or a representative in the European Union. Questions and requests regarding personal data can be addressed to the contact above with the subject line "Data protection". Requests concerning a research study are handled differently: please see Section 6.

‍

2. Personal data we process, and why

We only process personal data that is necessary for the purposes described below. We do not sell or rent personal data and we do not use it for advertising or profiling.

Visitors of our website

Server logs. When you visit www.mesenflow.com, our hosting provider automatically records technical data such as your IP address, browser type, date and time of access and the pages requested. This data is needed to deliver the website and to protect it against misuse and attacks. Server logs are deleted or anonymised by the hosting provider within a short period.

Contact form and e-mail. If you contact us through the contact form or by e-mail, we process the data you provide (typically your name, company, e-mail address, telephone number and the content of your message) to answer your enquiry and to follow up on it. Please do not send us sensitive data through the contact form.

Cookies. Our website does not use analytics, advertising, profiling or marketing cookies. Only strictly necessary technical functions required for the operation and security of the website are used, and no personal data is collected for behavioural tracking. You can find more detail in Section 9.

Customers, research partners and prospects

We process the business contact data of the persons who represent our customers, research partners and prospects (name, function, employer, professional contact details), together with contract, order, invoicing and correspondence data. We use this data to prepare and perform contracts, to provide our services, to invoice and collect payment, to maintain the business relationship and to inform existing customers about our services. You may object to such communication at any time.

Suppliers and service providers

We process the business contact data of the persons who represent our suppliers, consultants and service providers, together with contract, order and payment data, in order to select and manage suppliers, to place orders, to verify and pay invoices and to comply with our accounting obligations.

Job applicants

If you apply for a position with us, we process the data contained in your application (identification and contact data, CV, diplomas and certificates, work-permit status, interview notes) to assess your application and, where applicable, to prepare an employment contract. When your application is unsuccessful, we delete your file six months after the decision; with your consent we may keep it for up to two years to consider you for future positions.

‍

3. Legal bases under Swiss law

Under the FADP, processing of personal data by private companies does not require a specific legal basis as long as the principles of the Act are respected and the processing does not unlawfully breach the personality rights of the data subjects. The legal bases cited in this Policy under the GDPR describe the same processing from the perspective of EU law.

4. Who receives your data

Within MesenFlow, access to personal data is limited to the persons who need it for their work. We share personal data with the following categories of recipients only to the extent necessary:

• Service providers acting on our behalf (processors). We use a small number of carefully selected providers to host our website, to store and manage our documents and e-mail, to keep electronic laboratory records, to back up our data and to handle our payroll and accounting. These providers act on our instructions and are bound by data processing agreements. Our main providers are listed in Section 5.
• Banks, insurers and pension institutions for the execution of payments and the fulfilment of contractual and legal obligations.
• Public authorities, courts, regulators and ethics committees where we are legally obliged to disclose data or where this is necessary to protect our rights.
• Auditors, legal and other professional advisers who are bound by professional secrecy.
• Investigator sites and research partners in the context of research studies, as described in Section 6.

5. Data transfers outside Switzerland and the EU/EEA

Our data is stored in Switzerland and the European Union wherever possible. Some of our providers are established in the United States or may access data from there. The table below lists our principal providers and the safeguards that apply.

Microsoft Ireland Operations Ltd. (Microsoft 365)
• Purpose : E-mail, documents and collaboration
• Location and safeguard : Data hosted in the EU/Switzerland; support access from the USA. Microsoft is certified under the EU–US and Swiss–US Data Privacy Framework; EU standard contractual clauses with Swiss annex apply in addition.

‍Webflow, Inc.
• Purpose : Hosting of www.mesenflow.com and contact-form submissions
• Location and safeguard : USA. Certified under the EU–US and Swiss–US Data Privacy Framework; standard contractual clauses in the data processing agreement.

Benchling
• Purpose : Electronic laboratory notebook
• Location and safeguard : Hosted in Switzerland/EU. No transfer outside Switzerland or the EU/EEA.

Acronis
• Purpose :Encrypted cloud-to-cloud backup
• Location and safeguard : Hosted in Switzerland/EU. No transfer outside Switzerland or the EU/EEA.

Where data is transferred to a country that does not offer an adequate level of data protection according to the Swiss Federal Council or the European Commission, we rely on the recipient's certification under the Data Privacy Framework and on the standard contractual clauses approved by the European Commission and recognised by the Swiss Federal Data Protection and Information Commissioner (FDPIC), supplemented where necessary by additional technical measures such as encryption. You may request a copy of the relevant safeguards by contacting us.

‍

6. Research activities and pre-clinical studies

MesenFlow develops cell-based models and takes part in research and development projects, including early development studies in which it acts as sponsor. This Section explains how personal data of study participants is handled in that context.

What data we receive and how it is protected

Studies are conducted at research institutions, clinics and hospitals ("investigator sites") in Switzerland and the European Union under the responsibility of a principal investigator. The investigator site collects the identifying information of participants and holds the identification key. MesenFlow receives study data only in key-coded (pseudonymised) form: participants are identified by a study number, and the data we receive include limited demographic information. MesenFlow does not hold the key and cannot identify individual participants.

Requests concerning personal data in a study

Because MesenFlow does not hold identifying information, it cannot itself answer a request from a participant about his or her personal data. Any request regarding personal information related to a study, including requests to access, rectify or delete data, to withdraw consent or to obtain information about the study, shall be addressed to the principal investigator of the study, in accordance with the participant information sheet and/or the signed informed consent form. The information sheet indicates the name and contact details of the principal investigator and of the study team at your site. The principal investigator will handle your request and, where necessary, forward it to MesenFlow in key-coded form so that we can act on it, for example by stopping further use of your data.

If you contact MesenFlow directly about a study, we will not be able to identify you, but we will explain how to reach the principal investigator of your site.

7. How long we keep your data

We keep personal data only as long as necessary for the purposes described in this Policy and to comply with legal retention obligations. Unless a longer period is required by law or by a pending legal proceeding, the following periods apply:

• Website server logs : Deleted or anonymized by the hosting provider within a short period

• Contact-form and e-mail enquiries : Until the enquiry is resolved, then deleted; retained longer only if a business relationship follows

• Contract, order, invoicing and accounting records : 10 years after the end of the financial year

• Other data of customers, partners and suppliers : 2 years after the end of the business relationship or the last contact

• Unsuccessful job applications : 6 months after the decision; up to 2 years with your consent

• Key-coded study data and trial master file : 15 years after the end of the study, then deletion or anonymisation

‍

8. How we protect your data

We implement technical and organisational measures appropriate to the sensitivity of the data we process and to the size of our organisation, in line with our information security policy, which is oriented towards ISO/IEC 27001. These measures include named user accounts with multi-factor authentication, encryption of data in transit and at rest, full-disk encryption and centralised management of company computers, access limited to persons with a work-related need, protection against malware, regular updates and vulnerability assessments, encrypted backups with tested restoration, physical protection of equipment holding study data, and contractual data protection obligations for all service providers.

However, no method of electronic transmission or storage can be guaranteed to be completely secure. Should a breach of personal data occur that is likely to result in a high risk to you, we will inform you and the competent authority as required by law.
‍‍

‍

9. Cookies and website tracking

Our website does not use analytics, advertising, profiling or marketing cookies and does not carry out behavioural tracking.

The website may use strictly necessary technical functions required for its operation and security, for example to protect the contact form against automated abuse. Such functions do not require your consent.

Our website may contain links to third-party websites, such as LinkedIn; MesenFlow is not responsible for the privacy practices or content of those websites.

10. Your rights

Subject to the conditions and limits set out in the FADP and, where applicable, the GDPR, you have the right to:

• request information about whether we process personal data about you and to receive a copy of that data (right of access);
• have inaccurate or incomplete data rectified;
• have your data deleted, in particular where it is no longer necessary for the purposes for which it was collected;
• have the processing of your data restricted, and to object to processing based on our legitimate interests, including business-to-business communication;
• receive the data you have provided to us in a structured, commonly used and machine-readable format, or have it transferred to another controller (data portability);
• withdraw a consent you have given at any time, without affecting the lawfulness of processing carried out before the withdrawal.

To exercise these rights, please contact us at contact@mesenflow.com. We may ask you to verify your identity before answering. We respond within 30 days, or within one month under the GDPR, and will inform you if more time is needed. Requests concerning personal data in a research study must be addressed to the principal investigator of the study, as explained in Section 6.2.

You also have the right to lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC, Feldeggweg 1, CH-3003 Bern, www.edoeb.admin.ch) or, where the GDPR applies, with the supervisory authority of the EU Member State in which you live, work or where the alleged infringement took place.

11. Changes to this Policy

We may update this Privacy Policy from time to time to reflect changes in our activities or in the applicable law. The version published on www.mesenflow.com is the current one; the date of the last revision is indicated at the top of the document.

12. Applicable law

This Privacy Policy is governed by Swiss law, in particular the Federal Act on Data Protection (FADP) and its ordinance. Where our processing falls within the territorial scope of the GDPR, in particular because we offer services to persons in the European Union or conduct studies at investigator sites in the European Union, the GDPR applies in addition.