Privacy Policy

Introduction

This is the Privacy Policy of IntuVu Health Ltd of 1 Terenure Pl, Terenure, Dublin, D6W FN23, Ireland.

We are committed to complying with the General Data Protection Regulation and the Data Protection Act 2018, with specific regard to fair processing of personal data and transparency in our data processing policies, procedures and practices.

The purpose of this Privacy Policy is so that individuals understand how we collect, process, use and share any personal data that we hold about them. This policy is to be read in conjunction with our Cookie Policy that deals with the use of cookies in relation to the use of our website.

Please note that any personal data processed for health care purposes will be processed via the IntuVu Health Care App which has its own Privacy Policy to which you must consent to before use.

This Privacy Policy only applies to the use of our website https://intuvu.health

Contents

• Who are we?
• Why we collect information about you
• The information we process about you
• Why we use information and our lawful grounds
• Who we share your information with?
• Processing your information outside Ireland?
• What are my rights when you process my data?
• Contact us

1. Who Are We?

For the purposes of the General Data Protection Regulation (EU) 2016/379 ['GDPR'] and the Data Protection Act 2018, the data controller is IntuVu Health Ltd of 1st Floor Offices, Orwell Shopping Centre, Templeogue, Dublin, D6W TE88, Ireland.

We are committed to complying with the GDPR and the Data Protection Act 2018, with specific regard to fair processing of personal data and transparency in our data processing policies, procedures and practices.

We have prepared this Privacy Policy to help explain the personal data (information about you) that we may gather about you as a website user, the purposes for which we may process your personal data and information about your rights in relation to any data that we hold about you.

2. Why We Collect Information About You

We collect information about you so that we can:

• Deal with general website enquiries
• Assess any queries that you may have for us
• Comply with any legal obligations upon us as a business

Please note: All personal data processed in relation to your care will be processed by way of the IntuVu Health Care App which has its own Privacy Policy to which you must consent before use. We do not process any personal data for health care purposes directly from this website.

3. The Information We Process About You

Information You Voluntarily Provide

We may process information about you if you make an enquiry via our website.

If you wish to make any enquiry via our website (e.g. by email) you may be asked to provide us with personal data.

This information may include your:

• Title
• First and Last Name
• Email Address
• Telephone Number
• Job Title
• Company Name
• Nature of your Enquiry
• Any other personal data that may be required for us to process your enquiry

This personal data will not be disclosed to any third parties unless you provide us with your consent or we have a legal obligation to disclose same (discussed below).

Information We May Collect Automatically

When you visit our website, we may collect technical information about your visit including:

• Information about your visit, such as the website from which you accessed our site, your IP address (an IP address is a number that can uniquely identify a specific computer or other network device on the internet), the date and time of your access, the pages of our site that you visit, the links clicked, and the duration of your visit
• Information about your device, such as the type of browser you're using to access our site, the internet domain from which you access our site, the type of handheld or mobile device used to view the site (e.g. iOS, Android), the location of your device and the operating system of your device (e.g. Windows, Mac OS, iOS, Android)

Please refer to our Cookie Policy for specific information about the use of cookies on our website.

4. Why We Use Information and Our Lawful Grounds

Lawful Basis for Processing

We may only collect, use or store (process) your personal data where we have a lawful ground to do so as prescribed by law. Our lawful basis or ground for processing the personal data that you provide to us, or that we collect about you, may be based on the following:

Legitimate Interests: When we process personal data for our legitimate interests we may use such data for:

• Any contact or enquiry that you make with us via this website
• Contacting you with further information when you have voluntarily provided us with personal data, such as by making an enquiry with us
• General administrative purposes, such as maintaining proper records of any queries, complaints or any other business activities
• Complying with legal obligations and for the administration of justice
• Detecting and preventing fraud and other criminal offences
• To review, assess and develop our website

We will not use personal data for purposes that are incompatible with the purposes for which we collected it. If we intend to use your personal data for a new purpose, we will contact you beforehand to inform you and, if necessary, to ask for your consent.

Legal Obligation: In certain circumstances we may have a legal obligation to use your personal data, for example, in response to a court order, where we are ordered to disclose certain data by a court or tribunal, or to comply with any other applicable legal or regulatory obligation.

Vital Interests: In certain circumstances we may process personal data to protect the vital interests of an individual, for example, where someone's life is in danger.

Consent: In certain circumstances we may rely on your consent to process your personal data where no other lawful ground exists. Where we do rely on consent, we will ask you for your express consent and explain what the personal data will be used for. If you have any questions or concerns, or wish to withdraw your consent, then please contact us (contact details below). Please note that your withdrawal of consent may mean that we will not be able to perform the contract we have, or are trying to enter into with you. If so, we may not be able to provide you with the service in question and we will inform you if this is the case.

Automated Decision Making

We do not use any automated decision-making procedures that use your personal data.

5. Who We Share Your Information With

We do not sell your personal data to any third party.

If you have made an enquiry via our website or via any contact email, we may have to share your personal data with third parties (including professional advisors) in order to provide you with a proper response to your enquiry or to provide you with information or a service that you have requested. By providing us with your personal data, you are consenting to the disclosure of your personal data to such third parties that may be required to provide you with the information or service that you have requested.

We may share your personal information with, or disclose it to:

• Our employees, independent contractors and or professional advisors on a strictly need-to-know basis where there is a lawful ground for disclosure
• Professional advisors including legal advisors who may advise, represent or defend us in any actual or potential legal proceedings
• The Health Service Executive (HSE), the Health Information and Quality Authority (HIQA) or any other such public authority to whom we are required to disclose information to under law or by way of regulatory requirement
• The Data Protection Commission, where we are required or requested to do so
• Law enforcement or any governmental or other applicable regulatory authority

Business Transactions

In the event of a merger, acquisition, or sale of all or part of our assets, your personal information may be transferred to the acquiring entity, subject to the same protections described in this Privacy Policy.

6. Processing Your Information Outside Ireland

We do not process your personal data outside Ireland or the European Economic Area (EEA).

If it is necessary to process or store your personal data outside Ireland or the EEA, we will only do so where we are satisfied that there are adequate safeguards in place to protect your personal data. We will inform you if we need to process or store your personal data outside Ireland or the EEA and we will explain what safeguards are in place.

7. How Long Do We Keep Your Personal Data

We only keep your personal data for as long as we need it for lawful purposes and in accordance with our legal obligations.

The timeframes for keeping your personal data will depend on the reason that we collected and processed it. If we collected and processed your personal data:

• For the purposes of responding to a general enquiry: we will normally keep any details for a period of 7 years. Please note that if such data is relevant to any ongoing legal proceedings or a dispute, we will retain such data for the life of the legal proceedings or dispute plus 7 years.
• For the purposes of providing health care (via the IntuVu Health Care App): we will retain personal data in accordance with any applicable statutory requirements for a minimum period of 7 years from the date of your last access or use of the service. Please note that we may be required to retain certain personal data indefinitely if it related to child welfare or child protection or is relevant to any current, pending or potential legal proceedings.

When the relevant retention period has expired, we will securely delete your personal data in accordance with our data protection policies.

Storage and Security of Your Personal Data

We are committed to keeping your personal data safe and secure. We have implemented appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including measures to protect your personal data from accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

Your personal data may be stored electronically (e.g. in electronic databases, file storage systems and or our emails) or in hard copy format (e.g. physical files). Where we store your personal data in hard copy format, we will ensure that such data is stored in secure filing systems with appropriate access controls. Where we store your personal data electronically, we will ensure that such data is stored in secure systems with appropriate password protections, encryption, access controls and other appropriate technical and organisational safeguards.

We have put in place procedures to deal with any actual or suspected data breach and will notify you and the Data Protection Commission of a breach where we are legally required to do so.

Unfortunately, despite our best efforts, no method of transmission over the internet or method of electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your personal data, we cannot guarantee its absolute security.

8. What Are My Rights When You Process My Data?

You have a number of rights under the GDPR and the Data Protection Act 2018 in relation to your personal data. These rights are listed below.

If you wish to exercise any of these rights, please contact us at the contact details below. We will respond to your request without undue delay and within one month of receiving your request unless the request is complex or we have received numerous requests, in which case we may extend the time period by a further two months. We will inform you if we need to extend the time period.

Your Rights Include:

The Right to be Informed: You have the right to be provided with clear, transparent and easily understandable information about how we use your personal data and about your rights. This is the purpose of this Privacy Policy.

The Right of Access: You have the right to obtain from us confirmation as to whether or not we are processing your personal data and, where we are, to request access to your personal data. This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.

The Right to Rectification: You have the right to have any inaccurate or incomplete personal data corrected.

The Right to Erasure (Right to be Forgotten): In certain circumstances, you have the right to request that we delete or remove your personal data. This right is not absolute and only applies in certain circumstances. For example, we may be required to retain your personal data to comply with a legal obligation.

The Right to Restrict Processing: In certain circumstances, you have the right to request that we restrict the processing of your personal data. This right is not absolute and only applies in certain circumstances.

The Right to Data Portability: In certain circumstances, you have the right to receive your personal data in a structured, commonly used and machine-readable format and to transmit that data to another controller.

The Right to Object: In certain circumstances, you have the right to object to the processing of your personal data. For example, you have the right to object to processing of your personal data where we are relying on a legitimate interest.

Rights Related to Automated Decision Making Including Profiling: You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. We do not use automated decision-making.

Exercising Your Rights

To exercise any of these rights, please contact us using the details in the "Contact Us" section below. We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it.

We do not charge a fee for exercising your rights unless your request is clearly unfounded, repetitive or excessive. In such circumstances, we may charge a reasonable fee or refuse to comply with your request.

Right to Complain

You have the right to make a complaint to the Data Protection Commission if you are unhappy with how we have handled your personal data or believe we have not complied with our data protection obligations. The Data Protection Commission's contact details are:

Data Protection Commission 21 Fitzwilliam Square Dublin 2 D02 RD28 Ireland

Website: www.dataprotection.ie Telephone: +353 (0)761 104 800 Email: info@dataprotection.ie

We would kindly ask you to contact us first before contacting the Data Protection Commission so we can try to resolve any issue to your satisfaction.

9. Contact Us

If you have any questions about this Privacy Policy, wish to exercise any of your rights, or have any concerns about how we handle your personal data, please contact us:

Data Protection Team IntuVu Health Ltd 1st Floor Offices, Orwell Shopping Centre, Templeogue Dublin D6W TE88 Ireland

Email: dataprotection@intuvuhealth.com

We're sorry but we cannot deal with any data protection matters by telephone and ask that you write to the above address or email us your query and we'll be happy to help.

Changes to This Privacy Policy

We reserve the right, at our sole discretion, to amend this Privacy Policy at any time and without notice.

Any changes will become effective upon posting the revised Privacy Policy on our website at https://intuvu.health.

Website users should regularly check this Privacy Policy for any amendments or updates.