1. Introduction
At SBAS, we are concerned with the protection of your privacy and we engage to comply with the applicable laws on privacy protection in relation to the processing of your data. We collect, process, and store your Personal Data as you use mySmartBlood as it is defined in the Terms and Conditions. Personal Data is information that can reasonably identify you, such as your name, email or date of birth, biological sex, health data, or it may be information that can reasonably be linked back to you.
This Privacy Policy describes our practices for collecting, processing, and storing your Personal Data, and the controls we provide you to manage it within mySmartBlood.
Importantly, we do not collect, process, and store any Data Concerning Health (as defined below) for any other purpose than to provide you with the mySmartBlood report. Data Concerning Health (such as blood parameters linked to your Account and subsequent list of potential diseases) are stored within the Account, however we have implemented secure means that are intended to prevent ourselves as well as third parties to review such data. If you terminate your Account, all such data will be deleted. Given its sensitive nature, additional technical and organizational measures shall be taken to safeguard your information.
2. Definitions
Anonymized Information: any information that has been anonymized in a manner to result in the information no longer being able to reasonably identify an individual, whether directly or indirectly, and is therefore no longer considered as Personal Data.
Data Concerning Health: Personal Data related to the physical or mental health of a natural person, including the provision of health related services, which reveal information about his or her health status, as defined in Article 4 of the GDPR or similar provision under applicable data protection laws.
FADP: Swiss Federal Act on Data Protection.
GDPR: Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).
Personal Data: information that can be used to identify you, either alone or in combination with other information, as defined in Article 4 of the GDPR or similar provision under applicable data protection laws.
mySmartBlood: SBAS’ application intended for interpretation of blood results by way of advanced machine learning algorithms for medical use, as well as products, software, services, and website (including but not limited to text, graphics, images, and other material and information) as accessed from time to time by the user, regardless if the use is in connection with an account or not, and as defined in the Terms and Conditions.
SBAS: Smart Blood Analytics Swiss SA, whose principal place of business is at Höschgasse 25, CH-8008 Zürich, Switzerland.
Terms and Conditions: SBAS’ Terms and Conditions, available within mySmartBlood application when creating your account and under Settings – Terms and Conditions.
3. Registration Process and Your Engagement with mySmartBlood
Personal Data required to start the registration process is your name, biological sex, country of residence, email address and your date of birth (age).
Registration process also requires you to agree to the Terms and Conditions and this Privacy Policy by clicking “I accept the Terms and Conditions” and “I accept the Privacy Policy”.
By clicking “Register” you are telling us that you consent to SBAS collecting, processing, and storing your Personal Data, including special category data (such as Data Concerning Health), as described in this Privacy Policy and in any other documents referenced in this Privacy Policy.
4. What Personal Data Does Smart Blood Analysis Collect From You?
The table below describes the Personal Data we collect from you to provide you with mySmartBlood.
Data Category | Data Collected |
---|---|
Account Information |
|
Service Information |
|
Credit Card/Payment Information |
|
Your Communications |
|
5. What Information Does SBAS Collect Through Your Use of mySmartBlood?
Information category | Data Collected |
---|---|
Computer and Mobile Device Information |
Information about how you access mySmartBlood (as defined in the Terms and Conditions). |
Information from your use of mySmartBlood |
Information about your use of mySmartBlood, such as when you access your profile, location of the device, device language, IP address and related activities. |
6. How Does SBAS Use Your Personal Data?
Category | Use Description |
---|---|
Personal Data (Account Information and Service Information) |
We use your Personal Data to provide, personalize, improve, update and expand our Service. This includes:
|
Communications |
We use your Personal Data to communicate with you about mySmartBlood, such as when we:
|
Scientific and Research Purposes |
In order to support the research on development of AI in medicine and the corresponding care paths, we may use your data, pseudonymized or anonymized (without us being able to identify you) for research purposes. This may include sharing your data with carefully selected third party research institutions. By accepting our Terms and Conditions and our Privacy Policy and by performing measurements through mySmartBlood, you agree to the fact that your measurements being processed for the purposes of the provision of mySmartBlood and to be used in accordance with Article 89 GDPR or similar provision under applicable data protection laws and preferably pseudonymized for the purposes of research and testing of mySmartBlood. As such, your measurements may be reviewed by our employees or third-party consultants who work for us and who are bound by strict confidentiality. The processing of your Personal Data for scientific and research purposes shall be done based upon legitimate interest. If you no longer wish that SBAS uses your Personal Data (including health related data) you can object to this use, we shall only be able to use Anonymized Information. |
7. When Do We Share Your Personal Data and Who are the Recipients?
SBAS does not share your Personal Data with third parties without your additional consent other than as described in this Privacy Policy. The circumstances described below explain when sharing might occur:
People with whom your Personal Data may be shared / Circumstances in which sharing might occur | Description |
---|---|
Service Providers |
We use other companies to help us provide functionalities of mySmartBlood to you. As a result, these partner companies will have some of your Personal Data in their systems. Our partners are subject to contractual obligations governing data security and confidentiality consistent with this Privacy Policy and applicable laws. These processing partners include our:
Please note that the above list is not final and may be subject to change, depending on current circumstances. |
Legal or Regulatory Process |
We may share your Personal Data if we believe it is reasonably necessary to:
If we are compelled to disclose your Personal Data to law enforcement, we will do our best to provide you with advance notice, unless we are prohibited under the law from doing so or such action would circumvent the purpose of the enforcement. |
Research Institutions |
We may share your Personal Data in the manner as disclosed in section 6 above with applicable research institutions. |
In the event of a full or partial merger, or the takeover of SBAS in full or in part, we shall be permitted to relay your Personal Data to a third party for the purpose of executing the transaction, including a due diligence review. In that case, SBAS shall require the said third party to use any Personal Data only in strict compliance with the present Privacy Policy.
8. Your Choices, Rights and Access to Your Personal Data
Subject to certain exceptions, you have a right to request access to your Personal Data (along with information about the nature, processing and disclosure of your Personal Data), and to be provided with a copy of Personal Data you provided to SBAS, as well as to seek to update, delete or correct this information by contacting SBAS.
Please note that you can change your personal information in mySmartBlood at any time under the "Settings".
You also have a right not to provide your Personal Data to us. Exercising this right may however result in SBAS not being able to provide you with the full benefits of mySmartBlood. Additionally, you have a right to object to processing of your Personal Data, request restriction of processing of Personal Data, and to lodge complaints with a competent protection authority regarding the processing of your Personal data by us or on our behalf.
You may withdraw your consent at any time. When you wish to withdraw your consent, please contact us via the contact details at the bottom of this Privacy Policy. When you withdraw your consent, we will not be able to provide you with the mySmartBlood and you should discontinue using mySmartBlood.
Furthermore, the law permits us to as yet process Personal Data for the above purposes which, strictly speaking, are not necessary but which are useful with a view to the performance of the User Agreement ("Optional Personal Data"), if you give us your consent to do so. Please note: if you actively supply this information in response to our request, this may be considered as consent. For example: If you voluntarily provide us with additional information regarding your use of mySmartBlood, we may be obliged to communicate this Optional Personal Data on to the relevant regulatory bodies.
9. What are SBAS Retention Practices?
Generally, SBAS retains Personal Data on our system until our users inform us of their desire to delete their data or close their accounts. In some cases, we choose to retain usage information (e.g., visits to sites) in a depersonalized or aggregated form. Once aggregated, this information ceases to be personal and will not be subject to SBAS user deletion requests.
Data Category | Retention Period |
---|---|
Account Information Service Information |
|
Payment Information |
During the contractual relationship and for the subsequent 10 years due to tax regulations. As mentioned above, if you have chosen in-app payment or your operating system only supports in-app payment, SBAS does not process any payment information. |
Device Information |
During the contractual relationship and for the subsequent 2 years. |
Communications |
During the contractual relationship and for the subsequent 5 years. |
10. How can I Delete my Personal Data?
You can delete your Personal Data retained by SBAS by contacting us via email support@mysmartblood.com.
Please note that there may be some latency in deleting your Personal Data from our backup systems after it has been deleted from our systems. Also, our partners may retain certain information they receive from us in order to comply with laws or regulations that may require them to do so. SBAS may also retain certain information as reasonably necessary to comply with our legal obligations (including law enforcement requests), resolve disputes, maintain security, prevent fraud and abuse, as well as to comply with tax, payment industry, securities, and clinical regulatory compliance requirements.
11. Personal Information Regarding the Health of Others
mySmartBlood is intended for your personal use. If you want to help others, please do so by encouraging them to download their own version of mySmartBlood application. This could help them with their understanding of their health and ensure that any health-related messages will be delivered to the right person.
12. Security
SBAS maintains a comprehensive information security program designed to protect our customers’ Personal Data using administrative, physical, and technical safeguards.
The specific security measures used are based on the sensitivity of the Personal Data collected. We have measures in place to protect against inappropriate access, loss, misuse, or alteration of Personal Data under our control.
SBAS regularly reviews our security and privacy practices and enhances them as necessary to help ensure the integrity of our systems and your Personal Data.
We use latest standard security mechanisms while processing and storing Personal Data, and we only partner with security companies that meet and commit to our security standards. While we cannot guarantee that loss, misuse or alteration of data will not occur, we use reasonable efforts to prevent this.
We shall constantly strive to keep your Personal Data safe on our servers which are situated inside the European Economic Area.
It is also important for you to guard against unauthorized access to your Personal Data by maintaining strong passwords and protecting against the unauthorized use of your device. We request that all users assume their responsibility in protecting all login data and to immediately notify us of any unauthorized use of your individual Account.
13. Data Transfer
Your information, including Personal Data, may be transferred to — and stored on — servers located outside of your state, province, country, or other governmental jurisdiction where the data protection laws may differ than those from your jurisdiction. For example, as SBAS is based in Switzerland, and the server is located in Germany, certain data is transferred to those countries.
Your consent to this Privacy Policy followed by your submission of such information represents your agreement to that processing.
SBAS will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this Privacy Policy and the GDPR or other applicable data protection laws, and that no transfer of your Personal Data will take place to an organization or a country unless there are adequate controls in place including the security of your data and other personal data.
14. Changes to this Privacy Policy
We may modify this Privacy Policy at any time, but we will provide prominent advance notice of any material changes, such as posting a notice through mySmartBlood application, on our website, or by sending you an email, to provide you the opportunity to review the changes and choose whether to continue using mySmartBlood.
Please note that there may be some latency in deleting your Personal Data from our backup systems after it has been deleted from our systems. Also, our partners may retain certain information they receive from us in order to comply with laws or regulations that may require them to do so. SBAS may also retain certain information as reasonably necessary to comply with our legal obligations (including law enforcement requests), resolve disputes, maintain security, prevent fraud and abuse, as well as to comply with tax, payment industry, securities, and clinical regulatory compliance requirements.
15. Legal Basis under FDAP and GDPR for Processing of Personal Data
Where you have consented to data processing, your consent provides the legal basis to process your Personal Data. You have the right to withdraw consent at any time. Please note that your withdrawal of consent to collect and process your Personal Data will not affect the lawfulness of processing your Personal Data based on your consent before you withdrew your consent.
We also process your Personal Data on the basis of contractual necessity to perform a contract we have with you. We do not process your credit card or other payment means information, since this is the responsibility of the payment service provider.
We may also process your Personal Data on the basis of our legitimate interests, including in providing and improving mySmartBlood. For example, SBAS has a legitimate interest in understanding your login history so we can assess your interaction with mySmartBlood. We use your Personal Data to keep mySmartBlood safe and secure and we do so as it is necessary to pursue your and our legitimate interests in ensuring that mySmartBlood is secure, and to protect against fraud, spam and abuse.
Where we rely on legitimate interests to process your Personal Data, you have the right to object to such processing. You can use your Privacy Settings to control certain ways in which we process your data. You can also contact us, using the details below, to object to other forms of processing.
16. Identity and Contact Details
mySmartBlood customers can reach us at any time by writing us at support@mysmartblood.com.
Please note that SBAS also appointed a Data Protection Officer, who can be reached by writing an email at support@mysmartblood.com.
In addition, you may also have a right to lodge a complaint about how we handle your Personal Data with your relevant regulatory authority in terms of the applicable law that applies to you.
Regulatory Authority | Contact details |
---|---|
The European Commission |
Online complaint procedure: https://ec.europa.eu/info/about-european-commission/contact/problems-and-complaints_en Address: European Commission, Secretary-General B-1049 Brussels, BELGIUM Fax: 3222964335 |
The independent Data Protection Authority per Member State of the European Union |
Website listing all DPA's per member state: https://ec.europa.eu/justice/article-29/structure/data-protection-authorities/index_en.htm |
The Swiss Federal Data Protection and Information Commissioner, and cantonal and communal data protection commissioners |
Address of the Office of the Federal Data Protection and Information Commissioner FDPIC: Office of the Federal Data Protection and Information Commissioner FDPIC, Feldeggweg 1, CH - 3003 Berne, SWITZERLAND Fax: +41 (0)58 465 99 96 Website listing cantonal and communal data protection commissioners: https://www.edoeb.admin.ch/edoeb/en/home/the-fdpic/links/data-protection---switzerland.html |