At SBAS, we are concerned with the protection of your privacy and we engage to comply with the applicable laws on privacy protection in relation to the processing of your data. We collect, process, and store your Personal Data as you use mySmartBlood as it is defined in the Terms and Conditions. Personal Data is information that can reasonably identify you, such as your name, email or date of birth, biological sex, health data, or it may be information that can reasonably be linked back to you.

This Privacy Policy describes our practices for collecting, processing, and storing your Personal Data that is not protected health information, and the controls we provide you to manage it within mySmartBlood.

Importantly, we do not collect, process, and store any Data Concerning Health (as defined below) for any other purpose than to provide you with the mySmartBlood report. Data Concerning Health (such as blood parameters linked to your Account and subsequent list of potential diseases) are stored within the Account, however we have implemented secure means that are intended to prevent ourselves as well as third parties to review such data. If you terminate your Account, all such data will be deleted. Given its sensitive nature, additional technical and organizational measures shall be taken to safeguard your information.

Anonymized Information: any information that has been anonymized in a manner to result in the information no longer being able to reasonably identify an individual, whether directly or indirectly, and is therefore no longer considered as Personal Data.

Data Concerning Health: Personal Data related to the physical or mental health of a natural person, including the provision of health related services, which reveal information about his or her health status, as defined under applicable data protection laws.

FADP: Swiss Federal Act on Data Protection.

GDPR: Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) as well as any applicable local implementational regulations.

Personal Data: information that can be used to identify you, either alone or in combination with other information, as defined under applicable data protection laws.

mySmartBlood: SBAS’ application intended for the interpretation of blood results by way of advanced machine learning algorithms as clinical decision support, as well as products, software, services, and website (including but not limited to text, graphics, images, and other material and information) as accessed from time to time by the user, regardless if the use is in connection with an account or not, and as defined in the Terms and Conditions.

SBAS: Smart Blood Analytics Swiss SA, whose principal place of business is at Höschgasse 25, CH-8008 Zürich, Switzerland.

Terms and Conditions: SBAS’ Terms and Conditions, available within mySmartBlood application when creating your account and under Settings – Terms and Conditions, including potential individual User Agreements.

Personal Data required to start the registration process is your name, biological sex, country of residence, email address and your date of birth (age).

Registration process also requires you to agree to the Terms and Conditions and this Privacy Policy by clicking “I accept the Terms and Conditions” and “I accept the Privacy Policy”.

By clicking “Register” you are telling us that you consent to SBAS collecting, processing, and storing your Personal Data, including special category data (such as Data Concerning Health), as described in this Privacy Policy and in any other documents referenced in this Privacy Policy.

Subject to certain exceptions, you have a right to request access to your Personal Data (along with information about the nature, processing and disclosure of your Personal Data), and to be provided with a copy of Personal Data you provided to SBAS, as well as to seek to update, delete or correct this information by contacting SBAS.You may delete uploaded files and associated data at any time. Where permissible, you also have a right to seek data portability.

Please note that you can change your personal information in mySmartBlood at any time under the "Settings".

You also have a right not to provide your Personal Data to us. Exercising this right may however result in SBAS not being able to provide you with the full benefits of mySmartBlood. Additionally, you have a right to object to processing of your Personal Data, request restriction of processing of Personal Data, and to lodge complaints with a competent protection authority regarding the processing of your Personal data by us or on our behalf.

Where applicable, you may withdraw your consent at any time. When you wish to withdraw your consent, please contact us via the contact details at the bottom of this Privacy Policy. When you withdraw your consent, we will not be able to provide you with the mySmartBlood and you should discontinue using mySmartBlood.

Furthermore, the law permits us to as yet process Personal Data for the above purposes which, strictly speaking, are not necessary but which are useful with a view to the performance of the Terms and Conditions and/or User Agreement ("Optional Personal Data"), if you give us your consent to do so. Please note: if you actively supply this information in response to our request, this may be considered as consent. For example: If you voluntarily provide us with additional information regarding your use of mySmartBlood, we may be obliged to communicate this Optional Personal Data on to the relevant regulatory bodies.In certain cases, we may deny requests, such as when we suspect fraud, cannot verify your identity, or must retain your information to fulfill legal obligations.

Depending on the country of your residence, you may have the right to appeal if we decline to act on your request.

Please be informed that we do not sell any Personal Data.

You can delete your Personal Data retained by SBAS by contacting us via email [email protected].

Please note that there may be some latency in deleting your Personal Data from our backup systems after it has been deleted from our systems. Also, our partners may retain certain information they receive from us in order to comply with laws or regulations that may require them to do so. SBAS may also retain certain information as reasonably necessary to comply with our legal obligations (including law enforcement requests), resolve disputes, maintain security, prevent fraud and abuse, as well as to comply with tax, payment industry, securities, and clinical regulatory compliance requirements.

mySmartBlood is intended for your personal use. If you want to help others, please do so by encouraging them to download their own version of mySmartBlood application. This could help them with their understanding of their health and ensure that any health-related messages will be delivered to the right person.

SBAS maintains a comprehensive information security program designed to protect our customers’ Personal Data using administrative, physical, and technical safeguards. These measures are implemented in accordance with Article 32 GDPR, where applicable, or equivalent provisions under other applicable data protection laws in the user’s jurisdiction, which requires us to ensure a level of security appropriate to the risk presented by the processing of personal data.

The specific security measures used are based on the sensitivity of the Personal Data collected. We have measures in place to protect against inappropriate access, loss, misuse, or alteration of Personal Data under our control.

SBAS regularly reviews our security and privacy practices and enhances them as necessary to help ensure the integrity of our systems and your Personal Data.

We use contemporary standard security mechanisms while processing and storing Personal Data, and we only partner with security companies that meet and commit to our security standards. While we cannot guarantee that loss, misuse or alteration of data will not occur, we use reasonable efforts to prevent this.

We shall constantly strive to keep your Personal Data safe on our servers which are situated inside the European Economic Area.

It is also important for you to guard against unauthorized access to your Personal Data by maintaining strong passwords and protecting against the unauthorized use of your device. We request that all users assume their responsibility in protecting all login data and to immediately notify us of any unauthorized use of your individual Account.

Your information, including Personal Data, may be transferred to — and stored on — servers located outside of your state, province, country, or other governmental jurisdiction where the data protection laws may differ than those from your jurisdiction. For example, as SBAS is based in Switzerland, and the server is located in Germany, certain data is transferred to those countries.

Where Personal Data is transferred internationally, SBAS will implement appropriate safeguards as required under applicable data protection laws to ensure that your Personal Data remains adequately protected. Such safeguards may include, where applicable, the European Commission’s Standard Contractual Clauses, adequacy decisions, contractual data protection commitments, technical and organisational security measures, or other legally recognised transfer mechanisms.

We may modify this Privacy Policy at any time, but we will provide prominent advance notice of any material changes, such as posting a notice through mySmartBlood application, on our website, or by sending you an email, to provide you the opportunity to review the changes and choose whether to continue using mySmartBlood.

Please note that there may be some latency in deleting your Personal Data from our backup systems after it has been deleted from our systems. Also, our partners may retain certain information they receive from us in order to comply with laws or regulations that may require them to do so. SBAS may also retain certain information as reasonably necessary to comply with our legal obligations (including law enforcement requests), resolve disputes, maintain security, prevent fraud and abuse, as well as to comply with tax, payment industry, securities, and clinical regulatory compliance requirements.

Where you have consented to data processing, your consent provides the legal basis to process your Personal Data. You have the right to withdraw consent at any time. Please note that your withdrawal of consent to collect and process your Personal Data will not affect the lawfulness of processing your Personal Data based on your consent before you withdrew your consent.

We also process your Personal Data on the basis of contractual necessity to perform a contract we have with you. We do not process your credit card or other payment means information, since this is the responsibility of the payment service provider.

We may also process your Personal Data on the basis of our legitimate interests, including in providing and improving mySmartBlood. For example, SBAS has a legitimate interest in understanding your login history so we can assess your interaction with mySmartBlood. We use your Personal Data to keep mySmartBlood safe and secure and we do so as it is necessary to pursue your and our legitimate interests in ensuring that mySmartBlood is secure, and to protect against fraud, spam and abuse.

Where we rely on legitimate interests to process your Personal Data, you have the right to object to such processing. You can use your Privacy Settings to control certain ways in which we process your data. You can also contact us, using the details below, to object to other forms of processing.

mySmartBlood may contain links to other third-party sites that are not governed by this policy. If you click on a link to a third-party site, you will be taken to a site we do not control. We are not responsible for the privacy practices used by third-party sites. We suggest that you read the privacy policies of those sites carefully.

mySmartBlood is not directed to individuals under the age of eighteen (18), and we do not knowingly collect personal data from children under the age of 18. Any inputs of such data are strictly prohibited.

Nothing in this Privacy Policy shall limit, exclude, or reduce any mandatory rights or protections that a user may have under applicable data protection laws in their country, state, or jurisdiction of residence. Where local law grants users additional rights or imposes stricter requirements than those described in this Privacy Policy, such local law shall prevail to the extent required.

SBAS Is the data controller responsible for the processing of Personal Data as described in this Privacy Policy, unless stated otherwise. Users may exercise their privacy rights, submit requests, or contact SBAS regarding any privacy-related matter, regardless of their location, by emailing [email protected].

Please note that SBAS also appointed a Data Protection Officer, who can be reached by writing an email at [email protected].

In addition, you may also have a right to lodge a complaint about how we handle your Personal Data with your relevant regulatory authority in terms of the applicable law that applies to you.