Caregiver User

• Identity Data: first name, last name, username or similar identifier (i.e. email address)

• Contact Data: email address and telephone numbers and country of residence.

• Third-Party User Details: Patient Users details for access and input purposes, Healthcare Users details for access only purposes.

• Device Data: includes the type of mobile device you use, a unique device identifier (for example, your Device’s IMEI number, the MAC address of the Device’s wireless network interface, or the mobile phone number used by the Device), mobile network information, your mobile operating system, the type of mobile browser you use, time zone setting.

• Profile Data: includes your username or similar (i.e. email address) and password, in-App history, your interests, preferences, feedback and survey responses.

• Usage Data: includes details of your use of any of our Apps or your visits to any of Our Sites (including the Dashboard) including, but not limited to, traffic data and other communication data including what is uploaded/inputted onto the App related to the Patient User Health Data or otherwise.

• Marketing and Communications Data: includes your preferences in receiving marketing from us and our third parties and your communication preferences.

• Biometric Data (special sensitive data): fingerprints or face-recognition for the purposes of App login or security. Healthcare User

• Identity Data: first name, last name, username or similar identifier (i.e. email address)

• Contact Data: email address, telephone numbers, hospital name, town and country name.

• Third-Party User Details: Patient Users details and Caregiver Users details.

• Device Data: includes the type of mobile device you use, a unique device identifier (for example, your Device’s IMEI number, the MAC address of the Device’s wireless network interface, or the mobile phone number used by the Device), mobile network information, your mobile operating system, the type of mobile browser you use, time zone setting.

• Profile Data: includes your username or similar (i.e. email address) and password, in-App history, your interests, preferences, feedback and survey responses.

• Usage Data: includes details of your use of any of our Apps or your visits to any of Our Sites (including the Dashboard) including, but not limited to, traffic data and other communication data including what is uploaded/inputted onto the App related to the Patient User Health Data or otherwise.

• Marketing and Communications Data: includes your preferences in receiving marketing from us and our third parties and your communication preferences.

• Biometric Data (special sensitive data): fingerprints or face-recognition for the purposes of App login or security.

  AGGREGATED DATA USE

  We also collect, use and share Aggregated Data such as statistical or demographic data for any purpose. Aggregated Data could be derived from your personal data but is not considered personal data in law as this data will not directly or indirectly reveal your identity. For example, we may aggregate your Usage Data to calculate the percentage of users accessing a specific App feature. However, if we combine or connect Aggregated Data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this privacy policy.

  We may aggregate Patient User Health Data such as general moods and feelings of all Patient Users per time of the day, for the purposes of research, analysis, reporting or further knowledge and education and the Patient User will have provided us with the licence to do under the terms of the EULA which can be found here https://theswallows.org.uk/app-terms- conditions/ .

YOUR SPECIAL CATEGORY SENSITIVE PERSONAL DATA

As set out above, we do collect Special Categories of Personal Data about you (this includes details about your health, and genetic and biometric data). The basis of processing the Special Categories of Personal Data is your explicit consent.

We process the Special Category Biometric Data to allow you to login to the app using fingerprint and/or face recognition and otherwise to keep your App and profile secure. Your Biometric data will not be shared with anyone.

We process the Special Category Patient User Health Data to allow the Healthcare Users to access only the Patient User Health Data for those patients under their specific GP or hospital care on an individual and identifiable basis.

Your anonymised and aggregated Health Data may be shared with our research partners in accordance with the licence to do so granted by you under the terms of the EULA which can be found here https://theswallows.org.uk/app-terms- conditions/ .

HOW IS YOUR PERSONAL DATA COLLECTED?

We will collect and process the following data about you:

• Information you give us.

  This is information (including Identity, Contact, Third Party User Details, Health Data, Biometric Data and Marketing and Communications Data) you consent to giving us about you by filling in forms on the App Site or through the App or Dashboard, or by corresponding with us (for example, by email). It includes information you provide when you register to use the App Site, download or register an App, subscribe to any of our services, search for an App or service, share data or input data via the App’s functions, and when you report a problem with an App, our services, or any of Our Sites (including the Dashboard). If you contact us, we will keep a record of that correspondence.

• Information we collect about you and your device

  Each time you visit one of Our Sites (including the Dashboard) or use one of our Apps we will automatically collect personal data including Device, Content and Usage Data. We collect this data using cookies and other similar technologies. Please see our cookie section below for further details.

• Information we receive from other sources including third parties
  We will receive personal data about you from various third parties as set out below:

  • Device Data from the following parties:

  • analytics providers.

  • search information providers.

  • Contact, Financial and Transaction Data from providers of technical services.

  • Identity and Contact Data from Patient Users, Caregiver Users and/or Healthcare Users about each of their linked profiles to ensure the specific Caregiver Users and Healthcare Users for each Patient User can access data on the App or through the Dashboard.

    HOW WE USE YOUR PERSONAL DATA

    We will only use your personal data when the law allows us to do so. Most commonly we will use your personal data in the following circumstances:

• Where you have consented before the processing.

• Where we need to perform a contract, we are about to enter or have entered with you including the terms and conditions you have agreed to for using the App (EULA).

• Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.

• Where we need to comply with a legal or regulatory obligation.

We will only send you direct marketing communications by email if we have your consent. You have the right to withdraw that consent at any time by contacting us at [email protected] .

Once Patient Users have consented to share their Personal Data with Healthcare Users, the Personal Data (including Health Data) is shared with the Healthcare Users for direct care purposes under the lawful basis of ‘Public Task’, as Healthcare Users will usually meet the conditions of Article 9(2)(h) of the UK GDPR. As a result, the Healthcare User will not need the Patient Users consent to use, store or process the Patient Users’ Personal Data, including any sensitive Health Data. Personal Data which the Healthcare User receives may be included in, and form part of, the Patient Users’ medical record. The Healthcare User will be the data controller for all Personal Data held by it outside of our App and Dashboard and so the Healthcare User will process the Patient User Personal Data on the lawful basis of a ‘Public Task’. Further information can be found on the relevant Healthcare Provider’s Privacy Policy which can usually be found on their website.

PURPOSES FOR WHICH WE WILL USE YOUR PERSONAL DATA

Purpose/activity	Type of data	Lawful basis for processing
To install the App and register you as a new App user or Dashboard user	Identity Contact Device Biometric Data	Your consent
To deliver in-App services and access	Identity	Your consent
(including access to the Dashboard)	Contact Transaction Device Marketing and Communications Third-Party User Details Health Data Profile Data Usage Data	Performance of a contract with you Necessary for our legitimate interests Public Task (for Healthcare Users using Patient Users’ Personal Data)
To manage our relationship with you including notifying you of changes to the App or Dashboard	Identity Contact Profile Marketing and Communications	Your consent Performance of a contract with you Necessary for our legitimate interests Necessary to comply with legal obligations

To administer and protect our business	Identity	Necessary for our legitimate interests
and this App and the Dashboard including troubleshooting, data analysis and system testing	Contact Device Health Data Profile Data Usage Data
To deliver content and advertisements	Identity	Consent
to you To make recommendations to you about goods or services which may interest you To measure and analyse the effectiveness of the advertising we serve you To monitor trends so we can improve the App or Dashboard	Contact Device Content Profile Data Usage Data Marketing and Communications Health Data	Necessary for our legitimate interests (to develop our products and grow our business)
To carry out research and produce	Aggregated and Anonymised:	Consent
statistics, reports and other data (anonymised and aggregated) to be shared with third parties	Identity Data (such as ages and genders) Health Data (special sensitive data) Profile Data (such as preferences) Usage Data (such as input and usage)

DISCLOSURES OF YOUR PERSONAL DATA

When you consent to providing us with your personal data, we will also ask you for your consent to share your personal data with the third parties set out below for the purposes set out in the table above:

• Internal Third Parties: For Patient Users, we share your data with your nominated Caregiver Users and Healthcare Provider’s based on your consent so that they can access the information and data to provide you with health care services.

• External Third Parties: For Patient Users, we share anonymised and aggregated data with research partners for the purposes of further studies, research, and reports. For all users, personal data may be shared with out IT and App/Dashboard development team for development and monitoring purposes.

• Third parties to whom we may choose to sell, transfer or merge parts of our business or charity or our assets. Alternatively, we may seek to acquire other businesses or charities or merge with them. If a change happens to our business or charity, then the new owners may use your personal data in the same way as set out in this privacy policy.

INTERNATIONAL TRANSFERS

We do not transfer your personal data outside the UK save for the anonymised and aggregated data which is not considered personal data.

DATA SECURITY

All information you provide to us is stored on our secure servers. Where we have given you (or where you have chosen) a password that enables you to access certain parts of Our Sites (including the Dashboard), you are responsible for keeping this password confidential. We ask you not to share a password with anyone.

Once we have received your information, we will use strict procedures and security features to try to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way.

We will collect and store personal data on your Device using application data caches and browser web storage and other technology.

The Community Platform: Ensure when using these features that you do not submit any personal data that you do not want to be seen, collected, or used by other users.

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator when we are legally required to do so.

DATA RETENTION

By law we have to keep basic information about our users (including Contact, Identity, and Transaction Data) for six years after they cease being users for tax or other legal purposes.

In some circumstances you can ask us to delete your data: see the “Your Legal Rights” section below for further information.

In some circumstances we will anonymise your personal data (including Patient User Health Data) (so that it can no longer be associated with you) for research or statistical purposes, in which case we may use this information indefinitely without further notice to you.

YOUR LEGAL RIGHTS

Under certain circumstances you have the following rights under data protection laws in relation to your personal data. You have the right to:

• Request access to your personal data (commonly known as a “data subject access request”). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.

• Request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.

• Request erasure of your personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal data to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.

• Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your personal data for direct marketing purposes. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms.

• Request restriction of processing of your personal data. This enables you to ask us to suspend the processing of your

• personal data in the following scenarios:

  (a) if you want us to establish the data’s accuracy;
  (b) where our use of the data is unlawful, but you do not want us to erase it;
  (c) where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or
  (d) you have objected to our use of your data, but we need to verify whether we have overriding legitimate grounds to use it.

• Request the transfer of your personal data to you or to a third party. We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.

• Withdraw consent at any time where we are relying on consent to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain access to you. We will advise you if this is the case at the time you withdraw your consent.

  You also have the right to ask us not to continue to process your personal data for marketing purposes. You can exercise any of these rights at any time by contacting us at [email protected] .