Privacy Policy

Privacy Policy of My HealthCell Ltd 1. Introduction 1.1. This is the Privacy Policy of My HealthCell Ltd which explains how we comply with the General Data Protection Regulation (EU) 2016/679 (the “GDPR”) and other national and international applicable laws and regulations in all our business operations. 1.2. My HealthCell, as the data controller, has implemented appropriate measures and maintains comprehensive records demonstrating compliance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”). We assume full responsibility for the processing of your personal data. In all our business operations involving personal data processing, we are committed to adhering to the GDPR principles of: • Lawfulness, Fairness, and Transparency: Ensuring that personal data is processed legally, fairly, and in a transparent manner. • Purpose Limitation: Collecting personal data for specified, explicit, and legitimate purposes and not further processing it in a manner that is incompatible with those purposes. • Data Minimization: Ensuring that the personal data collected is adequate, relevant, and limited to what is necessary in relation to the purposes for which it is processed. • Accuracy: Taking all reasonable steps to ensure that personal data is accurate and kept up to date. • Storage Limitation: Retaining personal data only for as long as necessary for the purposes for which it is processed. • Integrity and Confidentiality (Security): Processing personal data in a manner that ensures its security, including protection against unauthorized or unlawful processing, accidental loss, destruction, or damage. • Accountability: Demonstrating compliance with these principles in all our personal data processing activities. 1.3. For the purposes of this Privacy Policy: • “Platform”: refers to both the My HealthCell Application and the My HealthCell Website, collectively operated by My HealthCell Ltd. This Platform facilitates the booking of medical appointments and the delivery of related services. • “My HealthCell”: All references to “us,” “we,” and “our” pertain to My HealthCell. • “You” and “Your” refer to: a. Health Professionals: The individual medical providers (licensed where applicable), employees, and contractors of health or medical clinics, hospitals, or other healthcare provider organizations who are registered on the Platform. b. Users: The patients who use our Platform (including making online bookings or communicating with Health Professionals), or who otherwise receive communications from their Health Professionals via our Platform. c. Other Individuals: Our individual contractors and suppliers, potential employees, other website users, and any other individuals we interact with in the course of running our business or providing our services. 1.4. We recognize the significance of your privacy and are dedicated to safeguarding it. This Privacy Policy is designed to provide you with a transparent overview of: • The types of personal information we may collect; • The purposes for which we may use, disclose, or otherwise manage such information; and • Your rights concerning access to and correction of your personal information. 1.5. In this Privacy Policy, “personal information” refers to any information or opinion about an individual that is reasonably capable of identifying that individual, as defined by the General Data Protection Regulation (EU) 2016/679 (“GDPR”). This includes, but is not limited to, health or other sensitive information (hereinafter “Personal Information”). We are committed to protecting and managing your Personal Information in compliance with the GDPR and any other applicable health records or privacy laws. 1.6. If you have any questions, concerns or feedback about this Privacy Policy, please contact us using our contact details contained in section 2 below. 2. Our Information 2.1. My HealthCell Ltd provides a comprehensive platform designed for the management of medical appointments and records. This platform, accessible via both mobile and web applications, allows users to book appointments and review their appointment history. Health professionals, access and utilize these services through a subscription model. 2.2. In compliance with the General Data Protection Regulation (“GDPR”), we inform you that My HealthCell Ltd acts as the “data controller”, responsible for decisions regarding the processing of your personal data. This applies when you use our official mobile application or visit our official website at www.myhealthcell.com, as well as any sub-websites operated by us. Your use of our mobile application and website is conditional upon your acceptance of our Website Terms and Conditions. 2.3. For this document and all privacy and personal data protection purpose, our information and contact details is as below: Company Name: My HealthCell Ltd Contact Email Address: [email protected] Registered Address: Viziinou 4, Nicosia, Cyprus Data Protection Officer: [email protected] Registration Number: HE 381397 3. Information We Collect About You 3.1. In order to provide our services and manage our operations, it is necessary for us to collect Personal Information. We may gather and retain your Personal Information for various purposes, including but not limited to verifying the identity of individuals before they access or use the Platform (website and/or application), facilitating appointments or communications between Patients and their Health Professionals, or enabling other functionalities of the Platform. Additionally, we may collect Personal Information as part of our routine business interactions. You can refer to the detailed policy sections below to learn more about the specific types of Personal Information we collect for different categories of individuals we engage with. 3.2. If you are a User: a. we will generally collect Personal Information about you in one of two ways: i. Directly from you or from a person authorized to act on your behalf (such as a legal guardian or representative) when you or they access or use the Platform. ii. From a Health professional with whom you have a patient relationship or appointment booking, to enable the functionality of the Platform or our provision of services to that medical professional. This information is collected only as necessary to support those functionalities or services and not for commercial purposes. b. the types of Personal Information we may collect, depending on the circumstances, include: i. general information such as: First Name, Last Name, Mobile Number, Email Address, Social Security Number (SSN), and Birthdate. Additionally, we gather location details such as Country, Region, City, Zip Code, Street Address, Building/Number (optional), Floor (optional), and Apartment (optional). ii. Health information may include details of appointments booked, confirmed, or cancelled; the content of communications with Health Professionals; information completed digitally on the Platform; and details about prescriptions, allergies, chronic conditions, vaccination history, and surgeries. iii. if you use or access our Platform (including the website), aggregated statistical information such as information about your online preferences and movements, and other information which is typically obtained from cookies (although you can adjust your browser’s settings to accept or reject cookies). If you are an unregistered user, this statistical information will be collected on an anonymized basis only. If you are a registered user, this statistical information may in some circumstances be collected on an identifiable basis; and iv. any other Personal Information you send or disclose to us, including our records of any communications or interactions we have with you. 3.3. If you are a Health Professional a. most Personal Information we collect about you will be received from you directly, your patients or potential patients, or the Organization that employs or otherwise engages you and b. the types of Personal Information we may collect about you include: i. general information such as your name, location, date of birth, contact information (including your email address, telephone and fax number, residential, business and postal addresses), your log-in details for the Platform, your profile picture and details of your use of, or access to, the Platform; ii. financial information such as any of your bank or credit card details used to transact with us, or other financial information that allows us to transact with you or provide you with our services, however credit card information will be held by a secure payment provider to ensure it is kept safe. We don’t see your full credit card number, nor do we store it, though we do have the ability to transact on your behalf to enable payment processing only; iii. details of any communications or interactions you have with a patient using the Platform – for example, details of an appointment with you that is managed using the Platform (and any related communications); iv. if you use or access our Platform (including the website), aggregated statistical information such as information about your online preferences and movements, and other information which is typically obtained from cookies (although you can adjust your browser’s settings to accept or reject cookies). If you are an unregistered user, this statistical information will be collected on an anonymized basis only. If you are a registered user, this statistical information may in some circumstances be collected on an identifiable basis; v. information about your professional registration, credentials, and experience, including your educational qualifications, associations or memberships, and any other information provided by you or your organization to be published on your profile or listing; vi. KYC (Know Your Client) documents, such as Identification (ID) and Medical License, which are used to verify that you are a certified medical professional and not an unauthorized individual impersonating a doctor and; vii. any other Personal Information you send or disclose to us, including our records of any communications or interactions we have with you. 3.4. If you are a contractor or supplier, potential employee, other website user, or any other individual we deal with in running our business: a. most Personal Information we collect will be received from you directly, however depending on the circumstances it might also be collected from third parties such as recruitment agencies, reference check providers, or our business partners; and b. the types of Personal Information we might collect about you will ultimately differ based on the circumstances, but might include: i. your name and contact details; ii. your professional qualifications or skills; iii. details of your employment history (including details of any personal or professional references provided to us by third parties); iv. financial information such as any of your bank or credit card details used to transact with us; v. if you use or access our Platform or website, or receive subscription email communications from us, we may collect statistical information using cookies or analytical services (although you can adjust your browser’s setting to accept or reject cookies), or by using pixel tags, which enable us to send email messages in a format customers can read and they tell us whether mail has been opened. If you are an unregistered user, this statistical information will be collected on an anonymized basis only. If you are a registered user, this statistical information may in some circumstances be collected on an identifiable basis; and vi. any other Personal Information you send or disclose to us, including our records of any communications or interactions we have with you. 4. How We Use the Information We Collect 4.1. My HealthCell uses the information we collect for the following purposes: i. To operate, provide, maintain, improve and enhance our Services; ii. To personalize your experience on our Services, such as by providing tailored content and recommendations. For instance, we use your email address to help you create, log into, and manage your account, allowing us to personalize your experience and deliver relevant information. iii. To understand and analyse how you use our Services and to develop new products, services, features, and functionality; iv. To connect you with a health professional that suits your needs; v. To communicate with you via email, text messages, push notifications and phone calls, in order to provide you with updates and other information relating to our Services, provide information that you request, respond to comments and questions, and otherwise provide customer support; vi. To facilitate transactions and payments; vii. For our business purposes, such as conducting audits, ensuring quality assurance, detecting and preventing fraud, and addressing trust and safety issues that may arise. viii. For compliance purposes, including enforcing our Terms of Use or other legal rights, or as required by applicable laws and regulations or requested by any judicial process or governmental agency. ix. For other purposes for which we provide specific notice at the time the information is collected. x. To aggregate or otherwise de-identify information collected through the Services and use and disclose it for other business purposes once the data can no longer be reasonably linked to an identifiable person. xi. To market and advertise products and services, including through inferred interests from interactions with our websites and apps. 4.2. We only process your Personal Information based on a valid legal ground, including when: i. Consent. By accepting our Terms and Conditions when registering for or using our Services, you consent to the use of your Personal Information for various purposes. This includes activities such as marketing, tracking your online activities via Cookies and similar technologies, and personalizing your experience. ii. Contract. We process your Personal Information as necessary to fulfil our contractual obligations to you. This includes actions such as account registration and management, facilitating transactions, responding to your inquiries, and providing you with our Services. iii. Legal Obligation. We use your Personal Information to comply with our legal obligations, such as adhering to tax and accounting requirements and complying with applicable national and international laws and regulations. iv. Legitimate Interest. We process your Personal Information based on legitimate interests that do not override your rights and interests. These interests include improving and developing our products and services, conducting internal analytics, and enhancing the safety, security, and performance of our Services. 5. Where We Store Your Information? 5.1. We, as the data controller, store your personal data on servers located within the European Union (EU). We primarily choose Data Processors based in the EU or European Economic Area (EEA) to ensure compliance with the General Data Protection Regulation (GDPR). In exceptional circumstances, we may engage third-party suppliers whose operations or servers are outside the EU or EEA. In these cases, we ensure your personal data is protected to GDPR standards through one of the following mechanisms: i. Adequacy Decision: Transferring data to countries deemed by the European Commission to provide an adequate level of data protection. ii. Standard Contractual Clauses: Using Standard Contractual Clauses approved by the European Commission, which are integrated into our contracts with Data Processors to safeguard your data. iii. Comparable Legal Instruments: Employing other legal mechanisms allowed under the GDPR to maintain high data protection standards. 5.2. You can request copies of such guarantees or additional information by contacting us at [email protected]. 5.3. Furthermore, we require our Data Processors to implement additional security measures, including specific security protocols and data protection certifications or provisions that comply with the GDPR. 6. How Long We Keep Your Information? We must comply with several legal obligations in relation to the retention and deletion of personal data. Therefore, in all cases, we will keep your data only for the period required for the purposes of processing stated herein, respecting the principle of “data storage” of GDPR. This means that as long as you remain a user of our system - you can edit this data at any point in time and request a deletion by cancelling the usage of the system. Since we keep backups of all databases for up to thirty (30) days, this data may still exist for up to thirty (30) days on our servers at which point in time it gets deleted. 7. Sharing of Your Personal Information 7.1. We may share or otherwise disclose Personal Information in the following circumstances: i. Affiliates: We may disclose Personal Information to our affiliates or partners to facilitate the provision of our Services or for the purposes for which the information was initially collected. ii. Service Providers: We may share Personal Information with trusted third-party service providers who assist us in operating our Platform, performing functions on our behalf, or providing related services. These providers may have access to Personal Information solely as necessary to perform their functions, which may include: • User Verification: Assisting with the verification of user credentials and account details. • Communication: Facilitating communication through various channels such as email or notifications. • Data Management: Handling the secure storage, processing, or analysis of data. • Analytics and Improvements: Conducting analytics to understand usage patterns and enhance our Services. We ensure that all service providers adhere to strict data protection standards to safeguard your Personal Information. iii. Legal and Regulatory Requirements: We may access, preserve, and disclose Personal Information if required or appropriate, in our sole discretion, to: • Comply with Legal Obligations: Adhere to applicable laws, regulations, legal processes, or governmental requests (e.g., court orders or subpoenas). • Protect Rights and Safety: Safeguard our rights, property, and safety, as well as those of our users and others. • Prevent Fraud and Security Issues: Protect the security or integrity of our Services and any related facilities or equipment. • Respond to Legal Claims: Investigate and defend against third-party claims or allegations. iv. Business Transactions: In the event of a corporate transaction such as a merger, acquisition, or sale of assets, we may disclose Personal Information to relevant parties (e.g., service providers, advisors, potential transactional partners) as part of the negotiation or completion of the transaction. v. Marketing: We do not rent, sell, or share Personal Information with non-affiliated companies for their direct marketing purposes unless you have explicitly given your consent. vi. Additional Service Providers: Occasionally, we may employ other service providers to perform specific functions, such as website development, IT services, or recruitment assistance. These providers may have access to Personal Information only to the extent necessary to perform their functions and are obligated to protect the confidentiality and security of this information. vii. Cookie-Based Analytics: We may use cookies and similar technologies for limited analytics purposes. These help us understand user preferences and improve our Services, but we do not use them extensively, nor do we allow third parties to use such data for their independent purposes. 7.2. We strive to ensure that any sharing of Personal Information is conducted with the highest level of security and only with parties committed to protecting your privacy in accordance with the GDPR. 7.3. All data processing activities with parties located within the EU and EEA are governed by the provisions of the GDPR and respective Data Processing Agreements. 7.4. When we transfer your personal data to a country not located in the EU or EEA: • we will check and ensure that specific legal mechanisms and safeguards are in place: and such us “adequate decision” (https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32021D1772) for that jurisdiction, concluded “Standard Contractual Clauses” (“SCC”) (https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en) or other; • we follow the recent developments in the law and do not rely on the Privacy Shield (https://www.privacyshield.gov/) but the Data Privacy Framework, to the extent applicable and valid; 8. Security, Privacy of medical data / Protected health information 8.1. We are committed to safeguarding your Personal Information through a combination of physical, electronic, and organizational measures. Our approach to data protection is designed to ensure the confidentiality, integrity, and security of the Personal Information we handle: i. Protective Measures: We employ a range of strategies, including secure environments, advanced technological safeguards, and comprehensive organizational practices, aimed at protecting your Personal Information from unauthorized access, misuse, and potential threats. ii. Regulatory Compliance: In interactions subject to specific regulatory requirements, such as the Health Insurance Portability and Accountability Act (HIPAA), we align our security measures to comply with applicable standards, ensuring appropriate protection of the Personal Information involved. iii. Risk Management: Recognizing the inherent risks in electronic data processing, we adopt a risk-based approach to data security. Our measures are continually updated to address new challenges and threats, reflecting our commitment to maintaining the highest levels of data protection. iv. Continuous Improvement: We are dedicated to evolving our security practices to keep pace with advancements in technology and emerging security risks, striving to provide robust protection while acknowledging that no system can guarantee absolute security. 8.2. Despite our extensive efforts to protect Personal Information, it is important to note that no method of electronic storage or transmission can be entirely secure. Therefore, while we aim to implement best practices and maintain rigorous security standards, we cannot provide absolute guarantees regarding the security or privacy of Personal Information. 9. Your Rights and Choices 9.1. You have a range of rights concerning your Personal Information. You may: i. Access: Request an overview or a copy of the Personal Information we hold about you. ii. Correction: Ask us to update or correct any inaccuracies in your Personal Information. iii. Deletion: Request the deletion of your Personal Information. iv. Restriction: Seek to restrict our processing of your Personal Information. v. Portability: Exercise your right to data portability, allowing the transfer of your Personal Information to another entity. vi. Objection: Object to the processing of your Personal Information in certain circumstances. vii. Withdrawal of Consent: Withdraw your consent for processing where consent was previously given. This will be applied prospectively without affecting the lawfulness of prior processing based on your consent. 9.2. To exercise these rights, please contact us using the details provided in this Privacy Policy. We are committed to addressing your concerns and maintaining a transparent relationship with you. If you have unresolved issues, you may lodge a complaint with the relevant supervisory authority in your place of residence, employment, or where the incident occurred. 9.3. Read the below section when you are outside the EU or EEA and GDPR does not apply. • The rights of Users in Switzerland are in line with the Swiss Federal Act on Data Protection (FADP) and provisions herein and include: access to Personal Data; right to object to the processing of their Personal Data (which also allows Users to demand that processing of Personal Data be restricted, Personal Data be deleted or destroyed, specific disclosures of Personal Data to third parties be prohibited); right to receive their Personal Data and have it transferred to another controller (data portability); right to ask for incorrect Personal Data to be corrected. • The rights of Users in Brazil are in line with the 'Lei Geral de Proteção de Dados' (LGPD) and provisions here. • The rights of Users in the USA, are in line with the California Consumer Privacy Act of 2018' (CCPA), as updated by the California Privacy Rights Act (CPRA) (collectively the “CCPA/CPRA”) and Virginia Consumer Data Protection Act (VCDPA), to the extent relevant and applicable to the business operations of My HealthCell. 9.4. My HealthCell Ltd does not sell or share Members' personal information. Individuals can exercise their rights free of charge via the contact details provided above or, where applicable, through their account, subject to certain conditions and exceptions as required by relevant law or regulation. These provisions override any other potentially divergent or conflicting information contained in this document. 9.5. Sharing Preferences. We provide you with settings to allow you to set your sharing preferences for content you post to our Services. i. Optional Profile Information. You can add, edit, or delete optional Personal Information appearing in your Profile at any time in your account settings under edit profile link. ii. Required Account Information. Certain Personal Information is required for account functionality and can be edited but not deleted. For example, you can edit, but not remove, the email address and password required for login. 9.6. Marketing Communications: Although My HealthCell currently does not implement marketing communications, such as notifications of new features or special offers, you can opt out of receiving these if and when they are introduced. You would be able to unsubscribe through a link provided in any future promotional emails. My HealthCell will never share your email address or other contact details with third parties for their own marketing purposes without your explicit consent. Even if you opt out of future promotional messages, you will still receive essential administrative communications from us. 9.7. Notifications. When you install our application, My HealthCell will ask for your permission to send notifications. If you agree, My HealthCell may send you email, SMS, or mobile push notifications to inform you about appointment confirmations, reminders, cancellations, or any updates related to your scheduled appointments. You can manage or opt out of these notifications at any time through the app’s notification settings screen or via your device's operating system settings. 9.8. Do Not Track (DNT). There is no accepted standard on how to respond to Do Not Track signals, and we do not respond to such signals. 9.9. Deactivating Your Account. To deactivate your account, sign in, navigate to the application settings, and select the deactivate your account option. Upon deactivation, you will receive a confirmation email. Note that even after your account is deactivated, your previously booked and resolved appointments will remain accessible to the medical professionals and patients involved for historical reference. Please note that deactivation is reversible, and you can reactivate your account at any time by signing in again. 9.10. Deleting Your Account: To delete your account, sign in, go to the application settings, and select the delete your account option. You will receive an email confirming that your account has been deleted. Please note that deleting your account is irreversible, and while your account will be deactivated immediately, your data may remain in our servers as part of routine backups for a retention period. For more details, refer to section six (6) of our current privacy policy. Even after your account is deleted, your previously booked and resolved appointments will remain accessible to the medical professionals and patients involved for historical reference. 10. Children Our Services are not intended for or directed to children under 18 years of age, and we do not knowingly collect Personal Information from children under the age of 13. If you learn that your child has provided us with Personal Information without your consent, then you may alert us at [email protected]. If we learn that we have collected any Personal Information from children under 13, then we will promptly take steps to delete such information and terminate the child's account. 11. Cookies, Third-Party Technologies (Statistics and analytics) and Sites 11.1. Our Services use several services provided by Google, Inc. ('Google'), including the services described below. i. Google Analytics. This Site uses Google Analytics, a web analytics service that uses cookies, which we use for the purpose of understanding how Members use our Services, compiling reports on website activity, and providing other information relating to website activity and internet usage. Google will not associate your IP address with any other information held by Google. ii. You may refuse the use of cookies by selecting the appropriate settings on your browser. However, if you delete cookies and/or prevent new ones, you will likely have to reenter preferences and settings every time you visit a website, and some services and functionalities may not work. iii. You can prevent Google's collection and use of data such as cookies and IP address by downloading and installing the browser plug-in available here. • https://tools.google.com/dlpage/gaoptout?hl=en-GB More information about how Google uses advertising cookies can be found here. • http://www.google.com/analytics/terms/gb.html iv. Google Maps. We use visual mapping services on the Site and/or our applications, please be aware that the Google Maps/Earth Terms of Service, including the Google Privacy Policy, at https://www.google.com/intl/en-US_US/help/terms_maps.html also applies. v. Third Party sites. Our Services may contain links to third-party sites. When you click on one of these links, you are visiting a website operated by someone other than My HealthCell, and the operator of that website may have different privacy policies. My HealthCell is not responsible for the individual privacy practices of those sites. Please be aware that this Privacy Policy does not apply to your activities on these third-party sites or any information you disclose to these third parties. We encourage you to read the privacy policies of third-party sites before providing any information to them. 11.2. Cookies. Like most websites, we use cookies - a file containing an identifier, a string of letters and numbers that is sent by a web server to a web browser and is stored by the browser and is then sent back to the server each time the browser requests a page from the server. Cookies can be either “persistent” and be stored by a web browser and will remain valid until its set expiry date, unless deleted by the user before the expiry date; or “session” and will expire at the end of the user session, when the web browser is closed. We wish to clarify here that cookies do not typically contain any information that personally identifies a user, but personal information that we store about you may be linked to the information stored in and obtained from cookies. If you need to know more, find everything in our Cookies Policy. 12. Changes To This Privacy Policy We reserve the right to change this Privacy Policy at any time. We will post any adjustments to the Privacy Policy on this page, and the revised version will be effective when it is posted. If we materially change the ways in which we use or share Personal Information previously collected from you through the Services, we will notify you through the Services, by email, or other communication.