Chipmunk Health Privacy Statement

Version: 2
Date: August 19, 2019

1. Privacy Statement Purpose

This Privacy Statement summarizes when and how your personal data is being collected, used, protected and disclosed in connection with your access to and use of our applications, websites and all functions, software and services offered through the applications and website, to be called “the Service”.

Chipmunk Healthcare Solutions B.V., trading under the name Chipmunk Health, is a Dutch company. Our business activities take place in the European Economic Area (EEA) and unless otherwise stated we store our data and that of our users on servers in EEA.

2. General

Chipmunk Health reserves the right to change the provisions of this privacy statement. If we make changes to the privacy statement, we will inform you accordingly. Most recent change stems from August 19, 2019.

3. Definitions

The Service: a care platform consisting of individual measuring devices (as specified in the Chipmunk Health Loan Agreement), a communication hub and a web portal for the user, to which this Privacy Statement applies (the Chipmunk Platform).

User: Patient or healthcare provider who uses the Service.

Third parties: means any natural or legal person other than Chipmunk Health, the patient or healthcare provider.

(User) account: the right of access to a user interface, with which the user can manage certain aspects of the Service.

User agreement: The agreement concluded between User and Chipmunk Health, whereby User gains access to the Chipmunk Platform, to which this Privacy Statement applies.

Loan agreement: An agreement between User and Chipmunk Health, in which User is given permission to use the items as described in the Agreement, to which this Privacy Statement applies. Care provider: the party with whom User enters into a Treatment Agreement with regard to the provision of certain care for which the Service is used as means of communication.  Personal information: all information about an identified or identifiable person.

4.What personal information do we collect, why and how long?

Personal data can be collected in a number of ways when you use the Service. The appendix contains an overview of the information that Chipmunk Health can collect. It is thereby indicated what personal information is or can be processed. A distinction is also made between the data that we process from users and data from care providers who use the Service. The overview shows which personal data are processed, for what purpose, on which legal basis the processing is based and how long the personal data is stored.

If you do not provide your personal details to Chipmunk Health or if you object in any other way to the use of your personal details by Chipmunk Health, this may cause you to be prevented from using the Service. Below is indicated per processing basis what the consequences are of not providing or objecting to the processing of personal data. You can find which personal data fall under which processing basis in the annex per service.

Processing based on a legal obligation of Chipmunk Health:

The personal information provided in this section is required to meet our legal obligations. Your access to the Service may be blocked or restricted and we may even terminate the agreement in accordance with our general (user) conditions. 

Processing necessary for the execution of the agreement: 

The personal information specified in this section is required for the Service to function properly or to be able to perform. You may be prevented from using the Service and the Service may not function properly. Your access to the Service may be blocked or restricted and we may even terminate the agreement in accordance with our general (user) conditions.

Processing necessary for the legitimate interests of Chipmunk Health:

The personal information provided in this section is required to meet the legitimate interests of Chipmunk Health and to prevent abuse of the Service and security incidents.

Your access to the Service may be blocked or restricted and we may even terminate the agreement in accordance with our general (user) conditions.

Processing that requires your explicit consent:

The personal information specified in this section is required for the Service to function properly or to be able to perform. However, since it concerns sensitive personal data, your explicit consent is required for the processing of this personal data. For that reason you have signed the form “Permission to Chipmunk Health to share / and use my medical data with third parties”.  You may be prevented from using the Service, the Service may not function properly.

5. Sharing of your personal data

Unless stated otherwise in this privacy statement, we do not describe, sell or trade personal information about and from our visitors and users to third parties.

5.1 Sharing with Processors

Chipmunk Health may engage third parties, such as hosting providers, to assist us in providing the Service. Those third parties may, in the context of their role in providing the Service, process your personal data. In this regard, such a third party is hereinafter referred to as “Processor.” We conclude processing agreements with these Processors.

Chipmunk Health uses the following types of Processors:

• Analytical software providers to improve our service (including cookie and server log analysis);
• Providers of analytical software for marketing purposes (including cookie analysis) to optimize the experience of the Service and to be able to offer personalized information;
• Providers of cloud services and hosting provider(s);
• Providers of email services;
• Providers of services for collecting health data;
• Providers of services for managing customer and user information.
• Video call providers;
• Providers for instant messaging traffic (chat services and text messages);
• Mobile text message providers (“SMS”); • Help desk ticket handling providers; • Providers of push notifications.

In some cases, the Processor may collect your personal information on our behalf. We inform

Processors that they are not allowed to use personal data they receive from us, except for the purpose of providing the Service. We are of course not responsible for any additional information that you provide directly to Processors. In such cases, you must inform yourself about the Processor and its organization before disclosing personal data to such Processors.

5.2 Sharing with your permission

Chipmunk Health may share personal information with third parties if you give us explicit permission to do so. For example, we can work with other parties to offer specific services directly to you. If you register for these third-party services, we may share the personal information you provide for it, such as name or other contact information that we reasonably consider necessary, with these third parties so that our partner can provide the services or contact you. 

5.3 Our legal responsibility

We are allowed share personal information if we can trust that this is legally permitted or if we are legally required to do so. We are also allowed to share personal information with third parties if this is reasonably necessary or appropriate in complying with the law, if this is necessary to comply with legal requests from authorities, to respond to any claims or to the rights, property or security to protect us, our users, our employees or the public and to, without limitation, protect ourselves or our users against fraudulent, abusive, inappropriate or illegal use of the Service. We will immediately notify you of requests from an executive, administrative or other government agency that we receive that are related to your personal information, unless prohibited by applicable law.

5.4 Anonymous information

Please note that nothing in this article limits the sharing of anonymized data. It may also be shared with third parties without your permission.

6. Protection of personal data

Chipmunk Health provides appropriate technical and organizational security measures for the processing of personal data. We follow generally accepted standards for the protection of personal data (ISO 27001 and 27002, NEN 7510), both during the transfer thereof and as soon as we have received the personal data. 

At a minimum, we have taken the following measures:

• Access to our servers and infrastructure is only possible from certain secure servers from specific IP addresses and is only possible through a specific combination of keys.
• Access to our database is only possible through multi-stage authentication and personal accounts that are protected with a username and password. Only persons who need access to the database for their task will receive such an account.
• We use a password policy to guarantee strong passwords. Passwords must be reset periodically.
• A firewall is present that is automatically configured and updated by means of security scripts.
• We use virtual private clouds per separate work environment (test environment, acceptance environment and production environment) to limit risks.
• Stored data is always protected by encryption. Passwords are also hashed. Locally stored data (for example on iOS and Android) is also stored encrypted insofar as it concerns sensitive information (medical information or authentication information). Locally saved data will be deleted if logged out.
• We use TLS (Transport Layer Security) technology to encrypt data traffic and identify the servers involved.
• The maximum number of incorrect login attempts is limited.
• All information entered by users is checked to ensure that no harmful data is uploaded.
• Software has been installed to detect malicious software in a timely manner.
• Security updates take place on a monthly basis.
• We monitor access to the back-end section to detect possible security breaches or other deviations.
• We back up the database every day. Users who have access to the database do not have access to the backups to prevent unwanted deletion of (parts of) databases.
• Cookies do not contain complete authentication information such as passwords.
• Information in cookies is deleted when you log out.
• Important information in cookies is encrypted.
• The duration of login sessions is limited in time.
• There is a policy regarding the use of data carriers (such as laptops and USB sticks).
• Access to our office and business premises is limited and secured.

You must bear in mind that our Processors are responsible for processing, managing or storing (part of) the personal data that we receive. Processors are not authorized to use this data for a purpose other than contributing to the Service. These Processors are contractually obliged, through a processing agreement that they have with us, to secure the personal data they receive from us. Despite all the measures, there is no way of transferring over the internet or an electronic storage method that is always 100% secure. 100% Safety can therefore never be guaranteed.

6.1 Links to third-party sites

Our Service and / or the website may contain links to other websites, as well as advertisements from third parties. Third-party websites may keep information about you. We have no control over such sites or their activities. Any personal information that you provide on the pages of third parties is provided directly to that third party and is subject to the privacy policy of that third party. We are not responsible for the content, privacy and security practices and policies of websites that we link to.

Links from our website to third parties or to other sites are only made available to you. We encourage you to study their privacy and security practices and policies before you provide personal information to them.

7. What options do you have regarding the use of your personal information?

Before we share your personal data with third parties in ways not covered by this privacy statement, including use for direct marketing purposes, you will be notified and asked to give consent when such information is collected. 

Chipmunk Health can send you marketing and promotional material about our products and services. If you no longer wish for your information to be used for direct marketing, you can contact us at the email address as listed under ‘Contact’.

You can also unsubscribe by following the unsubscribe instructions included with each promotional email. This does not affect our right and our ability to send you Services account related emails or use personal information as described in this privacy statement.

We will respond to your requests as soon as possible after receiving the request.

8. Your rights

• You can check, update, correct, or delete your relevant personal information collected by the website and the Service by emailing us at the email address listed under “Contact” or, if this feature is available, by using a designated function designed in the Service.
• Please note that the removal of personal information may result in the termination of the right to use the Service.
• We reserve the right to retain your personal data in our files if we believe that this is necessary or advisable to provide the Service to others, resolve disputes, maintain the applicable terms of use, for technical and / or legal requirements and / or if required by the Service.
• To gain access to your own personal data per email, you must provide sufficient proof of your identity per our request. We reserve the right to deny access to any user if we believe there are questions about your identity. We respond to all access requests within 4 weeks. For complex requests, the period can be extended by another 4 weeks. If we extend the period, we will inform you of this decision within 4 weeks of submitting the request.
• You can request us to limit or stop the processing of your personal data in the future. We comply with your request, but you may be hindered in your use of the Service and you may or may not be able to use the Service, as stated in Article 4 of this privacy statement.
• You may request us at reasonable intervals to transfer your personal information that we process, as specified by you, as long as the requested information does not contain personal data from other natural persons and as long as the requested information has been processed based on your consent or that processing is necessary for the performance of the Service. We will respond to your request within 4 weeks of receiving it.
• You have the right to submit a complaint to the qualified privacy authority that is related to our processing of personal data. For the Netherlands, this authority is the Personal Data Authority, which can be reached through www.autoriteitpersoonsgegevens.nl.

9. Contact

Should you have questions, problems or comments about this privacy statement, you can contact us per email at info@chipmunkhealth.com.