Data Privacy Policy for K+

Below we provide you (“you” or “User”) with an overview of what data we process in the K+ App ("App") and how we ensure the protection of your data.

Controller

The controller is the Medicus Group ("we/us/our" or " Medicus") consisting of:

Medicus AI GmbH

Lehargasse 11/1/8, 

1060 Vienna, Austria

Registration number: 

FN 458726y

Medicus AI Middle East Ltd.

2480, 24, Al Sila Tower

Abu Dhabi Global Market Square

Al Maryah Island, Abu Dhabi

United Arab Emirates

Registration number:

000002499

Your data will be used by us to provide the service of the App.

Personal data and applicable laws

Personal data are any information relating to an identified or identifiable natural person; an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his physical, physiological, mental, economic, cultural or social identity. Personal data includes e.g. name, email address or telephone number. Personal data also includes information about health, lifestyle or behaviors.

We will only collect, use and/or pass on personal data if this is permitted by law or if the User consents to the data processing. Consent means any freely given, specific, informed and unambiguous indication of the User's (data subject) wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.

Applicable legal provisions are in particular those of the regulation (EU) 2016/679 of the European Parliament and Council of 27 April 2016, repealing the directive 95/46/EC, on the protection of individuals with regard to the processing of personal data, on the free movement of such data ("General Data Protection Regulation", GDPR).

Data transfer outside the EU

When using our services and App, your data may be transferred to outside the EU to the controllers of the Medicus Group as set forth above, and also to our affiliated processors, Cloud Appers, Building no 16A, 2nd Floor Freezone Damascus, Jamarek Damascus, Syria, registration number 1953, and EOS Health SARL, Bshara El Khoury Street, Berytech Building, BDD 1294, Beirut, Mount Lebanon, 1100, registration number 1026304. All companies belonging to the Medicus Group as well as Cloud Appers and EOS Health SARL comply with data protection standards applicable in the EU via EU standard contractual clauses. Data can

also be transported to outside the EU to the parties listed in “Data we share with 3rd parties” section of this Data Privacy Policy, details are listed there.

Contacting us

When contacting us via email, your details are stored for the purpose of processing the enquiry and, if applicable, follow-up questions based on Art. 6 (1) b. GDPR.

Data we collect in the App

We process your data for the purpose of providing the services of the App. Such data may also include health data. The purpose of the K+ App is to provide you with test result insights, wellbeing tips, catered content, symptom/mood/diet tracking features and a pregnancy calendar to guide you through a smoother, healthier and more informed pregnancy. The K+ App is also supposed to help you collect, access and store all relevant data around your pregnancy in one place. To that end, we collect detailed personal and medical data in the App:

The personal and health data you provide when using the App is processed based on your consent according to Art. 6 (1) a. and Art. 9 (2) a. GDPR. You can revoke your consent at any time; if you choose to do so, we’ll stop processing your data from that point forward.

You provide data just if this is necessary for the aforementioned purposes. In the event you refrain from providing such data you may face legal disadvantages, for example, limited or no possibility of using our App.

Data we share with 3rd parties

To provide the services of the App, we have to share parts of your data with the following 3rd parties:

Keleya Digital Health-Solutions GmbH: We use servers of Keleya Digital Health-Solutions GmbH (“Keleya”) to host databases and application servers to provides the services of the App. Keleya is a limited liability company duly organized and operating under German law, having its offices at Max-Beer-Straße 25, 10119 Berlin, registered under HRB 213685 with the Commercial Register at the District Court Charlottenburg. Data processing by Keleya for the App is governed by a Controller-Processor-Agreement according to Art. 28 (3) GDPR. Keleya runs their server infrastructure on Amazon Web Services (“AWS”) in Germany and ensures compliance with GDPR through a Controller-Processor-Agreement with AWS in accordance with Art. 28 GDPR.

Zendesk: We use the services of Zendesk Inc., 1019 Market Street, San Francisco, CA 94103, USA (“Zendesk”), to allow you to send feedback about the app. When you use the Feedback function, data may be transferred to outside the EU. Zendesk is certified according to the EU- US agreement "privacy shield", which guarantees the level of data protection applicable in the EU.

Mandrill: We use "Mandrill", a software to send emails related to uploaded reports as part of the Scanning Service and to the registration process to Users' email addresses offered by The Rocket Science Group, LLC, 675 Ponce de Leon Ave NE, Suite 5000, Atlanta, GA 30308 USA. To that end, your email address is send to servers located in the USA. The Rocket Science Group, LLC, USA is certified according to the EU-US agreement "privacy shield", which guarantees the level of data protection applicable in the EU.

Mailchimp: We use "Mailchimp", a software to send emails related to info about the App to Users’ email addresses, offered by The Rocket Science Group, LLC, 675 Ponce de Leon Ave NE, Suite 5000, Atlanta, GA 30308 USA. To that end, your email address is send to servers located in the USA. The processing of data is based on your consent to receive email notifications from our Service according to Art. 6 (1) a. GDPR. The Rocket Science Group, LLC, USA is certified according to the EU-US agreement "privacy shield", which guarantees the level of data protection applicable in the EU. The privacy policy of Mailchimp is available at https://mailchimp.com/legal/privacy/.

Google Firebase, Google Firebase Crashlytics and Google Typeform: We use the services “Google Firebase” for push notifications, generation of universal links, gathering of analytical data and statistical testing, and “Google Firebase Crashlytics” to report malfunctions in the App. We use “Google Typeform” to send you customer surveys and analyze the anonymized results. All three services are offered by Google LLC, Mountain View, CA, USA (“Google”). Data collected are send to servers located in the USA. If the data are not anonymized the processing of data is based on our legitimate interests of a statistical analysis of the User relationship quality assurance purposes according to Art. 6 (1) f. GDPR. Google is certified according to the EU-US agreement "privacy shield", which guarantees the level of data protection applicable in the EU.

Bugsnag: We use the service “Bugsnag” to report malfunctions of the App. To that end, data is send to servers located in the USA. Bugsnag is offered by Bugsnag Inc., 110 Sutter St, Suite 1000, San Francisco, CA 94104, USA. Bugsnag Inc. is certified according to the EU-US agreement "privacy shield", which guarantees the level of data protection applicable in the EU.

Appsflyer: We use the service “Appsflyer” to collect app analytics and usage data. Appsflyer is offered by AppsFlyer Ltd., 14 Maskit St., Herzliya, Israel. The EU commission has recognized the level of data protection in Israel as adequate with GDPR standards (https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en).

Sign in with Apple: We support the service “Sign in with Apple” offered by Apple Distribution International Limited, Hollyhill Industrial Estate, Hollyhill, Cork, Republic of Ireland. This allows you to use your Apple ID (E-Mail address and password) sign in to our App. Both data items will be transferred to Apple’s servers to achieve the login. No other data is shared with Apple.

Scanning Service

In the event you choose to use our scanning service (“Scanning Service”) and upload a medical report via the K+ App, your data will be transferred to our research team with your explicit consent for the purpose of the Scanning Service only, based on Art. 6 (1) a. GDPR or Art. 9 (2)

  1. GDPR. The use of the Scanning Service is optional for each User. For convenience purposes, you may choose the option to upload your medical report(s) and/or related data (“Report Data”) instead of typing these data in the K+ App yourself. After you have clicked the button ‘Continue' within the App the Report Data provided for scanning within the App will be uploaded and transferred to Keleya’s server in Germany. Cloud Appers and EOS Health SARL (see Data Transfer outside the EU), as well as our research team, also located outside the European Union (EU) and/or the European Economic Area (EEA), will be able to access those Report Data there, and extract, verify and store those Report Data on Keleya’s server. This way, you may access those Report Data through the App without having to type in the Report Data yourself. After having provided the Scanning Service, we will keep the Report Data stored on Keleya’s server in Germany, for you to be able to access and retrieve the original Report Data whenever needed.

The use of this Scanning Service is optional and only possible if the you have created an account. You may also type in the data by yourself. You may receive information about such data and withdraw your consent for sharing such data anytime, for example, via email to: [email protected] We will delete such data in case of account deletion, request for data deletion by the User within the App, and, of course, in case of consent withdrawal.

Your Rights

Right to Access (Art. 15 GDPR)

You have the right to be informed at any time and free of charge about the personal data stored about you. For further information, you can contact e.g. [email protected]

This right of access includes confirmation as to whether or not personal data is processed on you and, if so, the detailed information about such processing.

The right to information does not exist if the data are only stored because they may not be deleted due to legal or statutory storage regulations, or only serve the purpose of data protection or data protection control and the provision of information would require a

disproportionate effort and processing for other purposes is excluded by appropriate technical and organizational measures.

Right to withdraw consent (Art. 7 GDPR)

You have the right to withdraw your consent regarding the use, processing or transmission of your data at any time with effect for the future when such data processing is based in your consent. For this purpose, the User can contact

[email protected]

In the event of withdrawing the consent, we will no longer process and immediately delete your stored data. This does not apply if we can prove compelling grounds for processing that are worthy of protection and which outweigh the interests, rights, and freedoms of the respective User or in case the processing serves to assert, exercise or defend legal claims. For example, we will continue to use data if it is still necessary for the implementation of the contractual relationship.

Correction and completion of data (Art. 16 GDPR)

You have the right to demand that we immediately correct any incorrect personal data concerning you. For this purpose, you can contact [email protected] at any time.

Erasure ("right to be forgotten ", Art. 17 GDPR)

You have the right to have us delete any personal data concerning you that we store. For this purpose, you can delete all data yourself or contact [email protected]

Immediate deletion shall be effected in the following cases:

In the event of termination of the User relationship, your data will be regularly deleted from the internal database. Data shall be excluded from deletion if, for example, processing of data is necessary for asserting, exercising or defending legal claims; e.g., performance of the contract with us or if there are legal retention periods that prevent deletion.

In the case of non-automated data processing, deletion is also not necessary if this would not be possible due to the special type of storage or would only be possible at disproportionately high expense and the interest of the Employee in the deletion is to be regarded as minimal. The deletion is then replaced by the restriction of processing.

Furthermore, we carry out a restriction of the processing and no deletion of the data, as long as and insofar as we have the reason to assume that a deletion would impair your interests worthy of protection or those of the person affected. In so doing, we will inform you or the affected person of the restriction on processing, provided that such information does not prove to be impossible or would require a disproportionate effort.

Restriction of processing (Art. 18 GDPR)

You also have the right to demand that the processing be restricted. For this purpose, you can contact [email protected] You can only successfully enforce the right to restrict processing if one of the following prerequisites is met:

Right to data portability (Art. 20 GDPR)

You have the right to receive any personal data you have provided to us in a structured, current and machine-readable format. For this purpose, you can contact [email protected]

You also have the right to data portability vis-à-vis another controller, provided that the processing is based on a consent or on a contract to which the data subject is a party and that the processing is carried out by means of automated procedures.

When exercising your right to data portability, you have the right to obtain the personal data to be transmitted directly by one person in charge to another person in charge, as far as this is technically feasible. This right shall not apply where the rights and freedoms of other persons are adversely affected or where processing is necessary for the performance of a task in the public interest or in the exercise of official authority delegated to the person responsible.

Right to lodge a complaint

You have the right to lodge a complaint vis-á-vis a supervisory authority of your choice. An overview of the European National Data Protection Authorities may be found here: http://ec.europa.eu/newsroom/article29/item-detail.cfm?item_id=612080.

Data Security

The App is operated through a safe SSL-connection. If an SSL-connection is activated, third parties are prevented from reading any data that are transferred by you to us. Your data are only stored on servers within the EU except as set forth in this privacy policy.

System logins to our servers by our research team and any 3rd parties involved, also located outside the EU/EEA, include a 2-factor authentication to ensure that only verified persons may gain access.

Contact Details; Data Protection Officer

For any inquiries and additional questions about processing personal data please contact [email protected] We have appointed a data protection officer who may be reached via [email protected]