Privacy

Data Protection Notice – EU version

May 31, 2021

Welcome to SCD Companion! This mobile app was designed with input and advice from people living with sickle cell disease. The app was developed by Curatio Networks together with Novartis Healthcare Pvt. Ltd. An important feature of this app is the way in which we protect your personal data. This notice explains what happens to your personal data when you use SCD Companion. If you have any questions or grievances, please contact Curatio’s Data Protection Officer at privacy@curatio.me.

1. Who is the Data Controller for SCD Companion? 

Curatio Networks Inc. decides what personal data to collect and how SCD Companion will work. 

Curatio makes and delivers SCD Companion and supports users. Curatio does not share personal data from SCD Companion with third parties      without the explicit consent of users.                     

Curatio Networks Inc. 
1200 – 555 West Hastings Street
Vancouver, B.C.
V6B 1M1

Toll free 1-855-888-2031
International +1 778 985 7907

info@curatio.me 

Curatio Data Protection Officer

privacyEU@curatio.me

Curatio EU Member Representative:

datarequest@datarep.com

https://www.datarep.com/data-request/

Curatio UK Member Representative:

DataRep
BPM 335368, 372 Old Street
EC1V 9AU
London, United Kingdom

datarequest@datarep.com

https://www.datarep.com/data-request/

2. What kind of personal data does SCD Companion collect?

Required:

• Account data - user name, email address

• Basic data - gender, age range, location (country, state/region)

• Health data - SCD diagnosis 

Optional:

• Pain crises information

• GPS location 

• User story

• Interests

• Other conditions

• Height, weight

• Medications

• Hospital visits - date, hospital location

• Allergies

• Insurance information - provider, policy number

• User activity - posts, comments, likes, wellness tracking, survey participation, behavioural activity from use of the app
  

3. What is the legal basis for processing your personal data?

Curatio uses your personal data when you give your consent (say it’s okay) and sign up for SCD Companion. 

4. What do we do with your personal data?

Curatio uses your personal data to:

• create your SCD Companion account;

• match you with other users; 

• let you to communicate with other users;

• let you track your pain crises, feelings and sleep over time;

• help you keep track of your doctors, hospital visits, insurance, and medicine; 

• create summary and aggregate data for Novartis about what users do in SCD Companion - Novartis won’t be able to tell who you are from this data;

• contact you with updates and information about SCD Companion; 

• understand how you use SCD Companion so we can improve it; 

• help you when you need it; and

• reply when you have questions or want to tell us something you like or don’t like about SCD Companion.  

Curatio knows who you are from the personal data you enter.  

Curatio uses information about you and what you do in SCD Companion to create data that doesn’t identify you or link you to your personal data. This anonymous data is used to understand the needs of the SCD community. We share and sell anonymous data generated by the use of SCD Companion to third parties, including Novartis Group companies. Third parties don’t see your personal data so they don’t know who you are.

Curatio does not sell, rent, or share your personal data. 

5. Who can see your personal data? 

Only certain technical Curatio employees will be able to see your personal data. They will see it only if they need to support you or if their work on SCD Companion requires them to see it. 

Curatio uses other companies to help deliver SCD Companion to you. These other companies can see your personal data. They are only allowed to use your personal data to deliver SCD Companion.

You decide which personal data other users can see. You can go to the “settings” tab on the app and choose to show your basic information, basic health information, story and interests to other users.  

When you post something to SCD Companion, you can choose to share it with the whole community, your circle, just one or two friends, or you can keep it private. 

Other users cannot see your personal data in your Health Passport.

Curatio adds a Curatio Community Manager to your circle when you set up your account. Your Community Manager is there to support you. She or he can send private messages to the entire circle and can remove posts that are not good for the SCD community.

Curatio uses these companies to help deliver SCD Companion:

• Amazon Web Services in Ireland

• Aptible in the United States – Curatio puts your personal data into code (“encrypts it”) before sending it to this company for safe keeping. This company can’t tell who you are.

• Apple Push Notifications in the United States – This company sends your messages to other users and sends SCD Companion messages to you, if you use an iPhone or iPad. This company does not keep the messages. 

• Firebase Cloud Messaging in the United States – This company sends your messages to other users and sends SCD Companion messages to you, if you use an Android device or web application. This company does not keep the messages.

• Google Analytics in the United States – This company collects information for Curatio about how you use SCD Companion. This company cannot tell who you are from what you do on SCD Companion.
  

6. Adverse Events

The law requires that pharmaceutical companies report unexpected or unwanted  reactions  to health products, known as “Adverse Events”, or side effects, that happen to someone using their medicine or treatments.  Your Community Manager will monitor what happens in SCD Companion and will report Adverse Events to Novartis. The Community Manager does not give Novartis the personal information of the user who has the Adverse Event. Instead, the Community Manager will contact the user in the app and give an email address for a Novartis Patient Safety Office. The user can then choose to contact Novartis or not to provide more information.      

7. How long do we keep your personal data? 

Curatio will keep your personal data while you are using SCD Companion. If you don’t use SCD Companion for five years, Curatio will remove your account and personal data from SCD Companion.

You can also go into settings to cancel your account and ask Curatio to remove your personal data from SCD Companion. Curatio removes your personal data by erasing it from the active database. It will take 60 days for Curatio to do this. 

Curatio regularly makes copies of SCD Companion for safe keeping. Curatio keeps these copies in a safe place for five years. It will take five years from the time your personal data are removed from SCD Companion for Curatio to remove personal data from the copies. 

8. How do we protect your personal data?

Curatio follows the privacy law in Canada, where Curatio is located, and is compliant with the General Data Protection Regulation (“GDPR”) in Europe and Switzerland’s Federal Act on Data Protection. Novartis also complies with European and Swiss data protection laws. Both companies use technical and organizational ways to protect your personal data. 

Curatio:

• Puts your personal data into code (“encrypts it”) when moving and storing it. 

• Removes your personal data if there is no need to have your personal data. 

• Makes sure that only employees who need to see your personal data to do their jobs can see your personal data. 

• Makes companies helping to deliver SCD Companion promise to protect your personal data. These companies may use personal data only under Curatio’s instructions to deliver SCD Companion.
  

9. What rights do you have to your personal data? 

You have the right to see and edit your personal data in the SCD Companion settings tab. You can also request a copy of your personal data there. You also have the right to:

• Withdraw your consent for Curatio and Novartis to keep using your data. You can do this by cancelling your account and asking Curatio to remove your personal data from SCD Companion.

• Correct your personal data.

• Limit or “restrict” the processing of your personal data.

If you have questions about your rights and how to use them, please contact Curatio’s Data Protection Officer.  

10. Are computers used to make decisions based on your personal data? 

Yes, when you sign up for SCD Companion we get your consent for Curatio’s computers to use a set of rules to look at your personal data and match you to other users of SCD Companion. SCD Companion then suggests these friends to you in the app. You decide if you want to invite a suggested friend into your circle. 

SCD Companion also suggests you as a friend to other users. The other users might send you an invite. You decide if you want to accept an invite into another user’s circle.

You decide how much personal data to give to SCD Companion. When you provide more data, your friend suggestions will be better matches for you and more likely to accept you into their circles. Remember, you can always update your profile with more information when you are ready.

11. Is SCD Companion for children? 

By design, SCD Companion does not collect personal data from users who are under sixteen (16) years old.

12. Is your personal data moved to a country other than your own? 

Curatio uses service providers in Ireland to deliver SCD Companion. Your personal data will be stored in Ireland.

Your Community Manager will be in the European Economic Area (“EEA”) or in Canada.  

Curatio employees who can see your personal data are in Canada.  

The European Commission and the Swiss Federal Data Protection Commission have decided that Canada provides enough protection for your personal data to be safe there. 

13. Where can you go to complain about how SCD Companion deals with your personal data? 

You can tell Curatio’s Data Protection Officer if you are worried about SCD Companion and your personal data. 

If telling Curatio’s Privacy Officer doesn’t help, you can tell the Canadian Privacy Commissioner:

Office of the Privacy Commissioner of Canada

You can also tell Novartis Country Data Privacy Head:

queries.dataprivacy@novartis.com

Or you can contact a Supervisory Authority in the EEA.