MOVESENSE ECG RECORDER APPLICATION

Data Protection Statement

1 General

This data protection statement in relation to Movesense ECG Recorder application (“Statement”) supplements and therefore also forms an integral part of the MOVESENSE ECG RECORDER APPLICATION – GENERAL TERMS OF USE as applicable from time to time (“TOS”) and the defined terms in this Statement shall have the same meaning as in the TOS unless otherwise specified in this Statement.

Moreover, this Statement and the Movesense Privacy Policy (as available at www.movesense.com) as well as other data protection statements applicable from time-to-time form together the Movesense Data Protection Policy. The definitions used in this Statement shall have the same meaning as in the Movesense Privacy Policy unless otherwise specified in this Statement.

This Statement governs the use of the User’s personal data in the Service (as defined in the Terms of Service, TOS), especially in relation to the Movesense ECG Recorder application. By installing, opening or using the Service, the User (as defined in TOS) agrees to the terms of the Data Protection Policy and any other terms of use contained in or related to them.

Movesense is the controller to data in the application and contact details are in the Privacy Policy.

2 Purposes of the processing

We process and collect the personal data mentioned in this Statement for the following purposes related to the Service:

• Provision and maintenance, development and securing of Movesense ECG Recorder application;
• Implementation, development, statistics compilation, reporting and analysis of customer service of Movesense ECG Recorder application;
• We collect and process health related data in relation to data produced from our products or in the Services such as the Movesense ECG Recorder application. This data includes for example electrocardiogram data (“ECG Data”). Such collection and processing of special category of data is subject to your consent in accordance with applicable laws and is also a precondition for us providing the Movesense ECG Recorder application to you.
  • After anonymization we may also use this special category of data for our further commercial and non-commercial purposes, such as product development, research etc. Anonymization means you will not be identifiable after the anonymization. After anonymization the stored data includes the following non-personal information: technical identifier, year of birth/age, gender.

3 Legal basis of processing

The legal bases applicable to the processing are: legal obligation, agreement, legitimate interest of the controller and consent.

• Legal obligation as a basis for processing is based on European Union law and applicable national law. A legal obligation may be related to, for example, accounting.
• Agreement as a basis for processing consists of Movesense’s TOS, as well as any special terms or other agreement applicable to the individual case in question. Agreement is the main legal basis for providing the Service.
• Where the legitimate interest of the controller is the basis for processing, legitimate interests include the direct marketing, development, improvement and protection of Movesense’s products and services, and other uses that are in Movesense’s legitimate interest under applicable law.
• You may at any time prohibit the processing of your personal data for direct marketing and profiling purposes.
• Consent as a basis for the processing of personal data described in this data protection statement is obtained using an appropriate method, such as ticking a box indicating your consent, making a choice in the technical settings of the service or website or another clear statement or action indicating your consent, depending on the product, website, service or application you use. In principle, such consent is always as easily revocable as it has been given. Consent applies as legal basis for the processing of the special categories of data as described in Section 4

4 What data we process and where the data are acquired from

We process personal data that we receive directly from the user as well as personal data that may be collected first by Movesense products and then transferred or otherwise operated through Movesense Service such as in this case the Movesense ECG Recorder application. Below you will find the categories, descriptions and source of personal data collected by Movesense in the Movesense ECG Recorder application.

4.1 Recipients or categories of recipients of personal data

Other processors as recipients

When Movesense processes personal data, they are sometimes shared with other parties. In this case, these other parties are processors of personal data, which refers to companies with which Movesense has a binding legal agreement. They may only process the data for the specific purposes permitted by Movesense and may only rely on third parties authorized by Movesense for said processing. Movesense may use external service providers, for example, to obtain technical solutions and services to process the stored data, as well as to use a special technical interface to open the stored data. Personal data may be shared with such service providers and third parties to the extent necessary for maintaining, developing and providing Movesense services. Movesense may also use services provided by third parties, such as software services, system services and payment service providers. Movesense has the right to share your personal data with the above parties to the extent necessary for providing these services.

Other controllers as recipients

Other parties may also be other data controllers, which refers to companies that have full responsibility toward the user for the use of the user’s personal data. They also have full responsibility for any third parties that may be involved in the processing of the user’s personal data. Movesense will only share these data when necessary for providing you with a product or service (for example, by providing information to providers of software, system or payment services) or, for example, if social media extensions, such as buttons or video content, are embedded on our sites. If you authorize Movesense to allow a third party or application to use your account data, we will share said data with a third party. We will not do this without your express permission, which you provide in the application. When you direct us to share information with a third party, such third party is responsible for the processing of personal data from that point on. Thus, it is your responsibility to carefully review the data protection policy of the third party.

More detailed descriptions of recipient groups

Movesense has the right to transfer personal data to a subsidiary or to a third party in the event of the reorganization, merger, sale, transfer or other assignment of Movesense’s business or part thereof, assets or shares, or in the event of a joint venture, provided that the party to whom we transfer the personal data is not, without specific notice and, if required by applicable law, without the customer’s permission, authorized to process your personal data for purposes other than those specified in this data protection statement.  Movesense may share user data (including personal data) in connection with a potential acquisition or sale of business, if Movesense or its business or part thereof is sold to the recipient of the data.

Anonymous data may be shared with advertisers, publishers, affiliates and other third parties.

5 Data transfer to third countries

Personal data may be transferred outside the European Union and the European Economic Area if the European Commission has adopted a decision on the adequacy of the protection of personal data in the countries where personal data is transferred to (so-called “Equivalence Decision”, Article 45 of the Data Protection Regulation). The transfer of personal data outside the EU and the EEA can also be done using standard contractual clauses (SCC, “Standard Contractual Clauses”) approved by the Commission.

Our products and services can be provided using resources and servers located in different countries. Therefore, your personal data may also be disclosed outside the country where the services you use are located. However, in all transfers to third countries, Movesense always complies with either an Equivalence Decision or Standard Contractual Clauses.

Should you require more information about the transfer of your personal data abroad, you can contact us.

6 Retention period of personal data

We will only retain your personal data for as long as necessary for the processing purpose in question or for as long as required by applicable law.

If you have registered with Movesense’s services, we will retain your personal data for as long as you have a username for the application or as long after the customer relationship as we deem necessary to retain the data.

7 Rights of the data subject

You have the following rights regarding your personal data:

• Right of access to personal data
  • We recommend that you take advantage of the profile management tools at your disposal, as these tools often give you direct access to your personal data and allow you to effectively manage your personal data.
  • You also have the right to request and receive the personal data we collect about you in a common and machine-readable format form by communicating with our customer service.
• Right to rectification
  • We recommend that you take advantage of the profile management tools at your disposal, as these tools often give you direct access to your personal data and allow you to effectively manage your personal data.
  • You can also contact our customer service if you believe we have other data of yours that may need to be rectified.
• Right to data erasure
  • We recommend that you take advantage of the profile management tools at your disposal, as these tools often give you direct access to your personal data and allow you to effectively manage your personal data.
  • You have the right to ask us to delete your personal data. However, we will not be able to delete personal data that are necessary for complying with binding legal obligations or that must be retained under applicable law.
• Right to restriction of processing and right of objection
  • You have the right to object to the use of your personal data for direct marketing purposes, for sending promotional materials, for profiling or for conducting market research.
  • You can also contact Movesense’s customer service to request a restriction on data processing or to object to any other form of processing.
• Right to data portability
  • You have the right to request and receive the personal data we collect about you in a common and machine-readable format form. If Movesense considers the request unreasonable, Movesense may charge the reasonable costs incurred from the transfer.
• If the processing is based on consent (or explicit consent), you have the right to withdraw the consent at any time.
• Right not to be subject to automated decision-making
  • Movesense does not make automated decisions about its users that would have legal or similar effects.

If you wish to exercise your above rights, you may, to the extent permitted by applicable law, contact us using the contact information provided in this data protection statement. However, this may mean that we can no longer provide you with those services, especially if you have requested us to delete or stop processing your personal data.

Please note that Movesense may need to identify you and request additional details, in order to fulfil your above requests. Please also note that applicable laws may contain restrictions and other provisions related to your above rights.

8 Right to lodge a complaint with a supervisory authority

If you are not satisfied with our data protection services or the processing of your personal data, you can address your question to the relevant authority (the Finnish Data Protection Ombudsman or, in processing related to cookies, Traficom).

9 Information security

Personal data may only be processed by persons whose duties justify this. The use of personal data is protected by appropriate personal credentials and access rights. Movesense has put in place appropriate technical and administrative safeguards to avoid and minimize the risks associated with the disclosure and processing of personal data. Such security measures include, where applicable, the use of firewalls, secure server facilities and encryption, the establishment of appropriate access control systems and processes, the careful selection of processors, adequate training of Movesense staff involved in the processing, and other measures necessary for protecting personal data from unauthorized access or disclosure.

10 Updates of the data protection statement

In order to improve our services, and as legislation changes, we may also update our data protection statement. We always recommend that you re-read the statement at regular intervals. We will notify you of material changes by e-mail or on our website.

Contact information:

Movesense Ltd
www.movesense.com
info@movesense.com