PRIVACY POLICY
VivaChek Polska Sp. z o.o. acts as Data Controller (collectively, VivaChek "we", "us", or "our") for the processing of your personal data when using the Klinion mobile application, and connected devices (collectively, the "Services").
We are committed to protecting your privacy in accordance with the EU General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679). This Services is strictly intended for users residing within the European Union (EU), and all personal data collected is hosted on secure cloud infrastructure located exclusively within the EU.
1. Data Controllers and Data Protection Officer (DPO)
- Controller:
- VivaChek Polska Sp. z o.o.
- Contact Email: privacy@vivachek.com
- Data Protection Officer: You can reach our Data Protection Officer regarding all privacy-related matters at privacy@vivachek.com or via our physical address.
2. Categories of Data Collected and Legal Bases for Processing
The legal basis for which we process your personal data are as follows.
| Data Category | Specific Data Points | Legal Basis (GDPR) |
|---|---|---|
| Account & Profile Data | Name, email address, phone number, age/date of birth. | Contract Performance (Art. 6(1)(b)) |
| Health Data | Blood glucose levels, insulin dosages, diabetes type, year of diagnosis, A1C levels, connected glucose meter logs, notes/moments containing health observations. | Explicit Consent (Art. 9(2)(a)) |
| Device & Sensor Access Data | Photos, camera access, connected device identifiers. | Explicit Consent (Art. 6(1)(a)) |
| Lifestyle Data | Meal markers, physical activities logs. | Explicit Consent Art. 9(2)(a) |
| Technical & Usage Logs | App feature interactions, access timestamps. | Legitimate Interests |
| Device Data | IP address, device ID, operating systems, serial number, | Explicit Consent (Art. 6(1)(b)) |
3. How We Use Your Data
We process your data strictly for the following purposes:
- Performance of Contract: To perform Vivachek’s obligations under the Terms of Use executed with the User or his/her legal representatives in accordance with Article 6.1.b of GDPR.
- Providing & Personalizing Services: To calculate trends, track health parameters, sync with Connected Devices, and maintain your account.
- Customer Support & Communications: To respond to technical inquiries, send mandatory administrative alerts (updates to terms, security notices), and deliver service updates.
- Product Safety & Quality Assurance: To maintain network and information security and diagnose software operational bugs.
Note: We do not process your health data for automated decision-making or profiling that produces legal effects concerning you without your explicit consent under Article 22 GDPR.
4. Data Storage, Location, and Security
- Data Location: All personal data collected through the App is processed and stored on cloud servers situated exclusively within the European Union (EU). We do not transfer your personal data outside the European Economic Area (EEA). Neither is there access of your personal data outside EEA.
- On-Device Storage: Certain data (such as login tokens or exported health logs) may be stored locally on your mobile device. You can clear local data by uninstalling the application or clearing the application cache via your operating system.
- Security Safeguards: We implement robust technical and organizational measures (pursuant to Art. 32 GDPR), including end-to-end transport encryption (TLS/SSL), database encryption at rest, strict access controls, and regular vulnerability assessments.
5. Sharing and Disclosure of Information
We do not sell or share your personal data. We share data only under the following strictly defined conditions:
- User-Initiated Sharing: When you explicitly choose to export or send health reports to family members, caregivers, or healthcare providers. In situations where your personal data is shared as described above, we will obtain your explicit consent before disclosing your data to the relevant third party.
- Data Processors (Vendors): We engage third-party service providers (e.g., EU cloud hosting providers, customer support software) acting strictly as Data Processors under signed Data Processing Agreements (DPAs) pursuant to Article 28 GDPR.
- Legal Requirements: If required by mandatory EU or EU Member State law, court orders, or requests from law enforcement agencies.
- Corporate Restructuring: In the event of a merger, acquisition, or asset sale, your personal data will only be transferred subject to equal privacy safeguards and prior notification to you.
6. Data Retention Period
We retain your personal data only as long as necessary to fulfill the purposes for which it was collected:
- Account & Health Data: Retained for as long as your account remains active. If you delete your account or withdraw consent, your health data will be permanently deleted or irreversibly anonymized within 30 days.
- Support Logs & Correspondence: We retain support logs and correspondence for as long as necessary to provide customer support, resolve disputes, maintain appropriate business records, and comply with applicable legal obligations. We periodically review these records and delete or anonymize them when they are no longer required.
- Local Device Storage: Retained on your mobile device until you delete the app or clear its local storage.
7. Your GDPR Rights
As an EU data subject, you hold the following statutory rights under Articles 15–22 GDPR:
- Right to Access (Art. 15): Request a copy of all personal data held about you.
- Right to Rectification (Art. 16): Correct inaccurate or incomplete data.
- Right to Erasure ("Right to be Forgotten") (Art. 17): Request the deletion of your personal data where consent is withdrawn or processing is no longer necessary.
- Right to Restriction of Processing (Art. 18): Request that we temporarily suspend data processing under specific legal conditions.
- Right to Data Portability (Art. 20): Receive your personal data in a structured, commonly used, machine-readable format (e.g., CSV/JSON).
- Right to Object (Art. 21): Object to processing based on legitimate interests.
- Right to Withdraw Consent: Where processing relies on your consent (especially for health data), you have the right to withdraw your consent at any time through application settings or by contacting us, without affecting the lawfulness of processing prior to withdrawal.
To exercise any of these rights, please contact us at privacy@vivachek.com. We will respond within one month of receiving your verified request.
8. Protection of Minors
Our Services are intended for individuals who are adults, or children whose use is supervised by a parent and/or legal guardian (or the applicable legal age of digital consent in your EU Member State). We do not knowingly collect personal data from children under 16 without explicit verifiable parental or guardian consent. If we become aware that a child under 16 has registered without authorization, we will immediately delete their data.
9. Right to Lodge a Complaint
If you believe our data processing violates EU data protection law, you have the right to lodge a complaint with a supervisory authority in the EU Member State of your habitual residence, place of work, or the place of the alleged infringement.
For instance, you may contact our lead supervisory authority or a national supervisory authority in your home country (e.g. Germany).
Our lead supervisory authority in Poland is: Urząd Ochrony Danych Osobowych (UODO)
10. Amendments to This Policy
We reserve the right to update this Privacy Policy to reflect changing legal requirements or service enhancements. Material changes will be communicated to you via push notification, in-app pop-up, or email prior to taking effect, alongside an updated "Effective Date". Continued use after changes take effect indicates your acknowledgment of the updated terms.
11. Contact Us
For questions, requests, or privacy inquiries:
- Email: privacy@vivachek.com
- Postal Address: Vivachek Polska Sp. z o.o., Poland
Annex: List of Data Processors (Vendors)
Alibaba Cloud LLC
Apple Inc.
Google LLC
Health Report Sharing Consent
1. Purpose of This Consent
- You may choose to share your health report with a person or organisation of your choice, such as a family member, caregiver, or healthcare provider.
- By providing your explicit consent below, you authorize VivaChek to disclose the health information identified in this form to the recipient you select.
- Sharing is optional. You can continue to use the service without providing this consent.
2. Information to Be Shared
- Please select the health information you want to share:
- Full health report
- Selected health measurements and records
- Health trends and summaries
- Other: ______________________________
- The report may contain sensitive health information and other personal nformation associated with your account.
- Only the information you select will be shared.
3. Recipient
- I choose to share my selected health information with:
- Recipient name: __________________________________
Recipient type:
- Family member
- Caregiver
- Healthcare provider
- Other: ______________________________
Recipient email / contact information:
4. Purpose of Sharing
- I understand that my health information will be shared for the following purpose:
- Personal support or family communication
- Caregiving
- Discussion with a healthcare professional
- Other: ______________________________
- The information will not be shared for any additional purpose by VivaChek unless another lawful basis applies or I provide any consent required by applicable law.
5. Method of Sharing
- I understand that VivaChek will transmit the selected health information using the sharing method presented to me in the app.
- Where applicable, the information may be provided as a downloadable report, electronic message, secure link, or other sharing mechanism.
- I understand that once the report has been delivered to my selected recipient, VivaChek may not be able to control how that recipient subsequently stores, copies, forwards, or otherwise uses the information.
6. Duration of Sharing
- Unless otherwise stated above, this consent applies only to the specific sharing action described in this form and does not authorize future sharing of my health information.
7. My Consent
- I confirm that:
- I have read and understood this consent form.
- I understand that the information being shared may include sensitive health information.
- I have voluntarily chosen the recipient identified above.
- I understand the purpose and method of sharing.
- I understand that sharing is optional and is not required to use VivaChek.
- I understand that VivaChek cannot control the recipient's subsequent use, storage, copying, or disclosure of the information after it has been received.
- I understand that I may withdraw my consent for future sharing at any time through [App Settings / Privacy Settings / Contact Method].
- I understand that withdrawal of consent does not affect processing or sharing that occurred lawfully before withdrawal.
Explicit Consent
- I explicitly consent to VivaChek sharing the health information I selected above with the recipient identified in this form for the purpose specified above.
- I agree and authorize this specific sharing of my health information.
- User name: __________________________________
- Date: _______________________________________
- Consent record / transaction ID: __________________
8. Withdrawal of Consent
- You may withdraw your consent for future sharing at any time by contacting:
- Privacy Contact: [privacy@vivachek.com]
- Withdrawal should be as easy as providing consent. Where technically applicable, withdrawal will prevent future sharing but cannot undo information that has already been delivered to the recipient.
9. Privacy Information
- For information about how VivaChek collects, uses, stores, protects, and deletes personal and health information, please see our Privacy Policy.
- Data Protection Contact / DPO: privacy@vivachek.com
- Important implementation note: The system should record the version of this consent form, date/time of consent, identity of the user, exact report/data categories selected, recipient, stated purpose, sharing method, and withdrawal status so that VivaChek can demonstrate what the user consented to.