Privacy Policy - myHedera

1. Introduction

This privacy policy explains how the “myHedera” app, part of the EMPATHY NSCLC Registry study, processes your personal data in compliance with applicable data privacy laws, including the General Data Protection Regulation (GDPR). By using the app, you consent to the collection, processing, and storage of your personal information as described in this policy.

2. Data Privacy Laws

We comply with all relevant data privacy regulations, including the GDPR and other applicable European privacy laws. The legal basis for processing your data is grounded in these laws, which ensure the security and proper use of your personal data.

3. Privacy Audit

As part of our privacy practices, we conducted a thorough audit to identify all personal information collected through the app, including cookies, trackers, and direct user inputs. We ensure that all such data is documented and processed in line with legal obligations.

4. Categories of Personal Information We Collect

The app collects the following categories of personal data:

• Personal health information: Details about your experience with cancer, diagnostics including liquid biopsy, and your treatment outcomes.
• Identifiers: Study ID assigned to you (pseudonymized), phone number and IP address.
• Questionnaire responses: Information you provide regarding your quality of life, disease experience, and treatment history.
• Device information: Technical data such as the type of device and preferred language.

We do not collect or process sensitive personal data beyond what is essential for the study unless explicitly authorized by you. Note: Your phone number is only utilised for authentication and is removed before performing any analysis or research with the data.

5. Why We Collect Personal Data

The collection of your personal data is necessary for:

• Scientific research into NSCLC to improve treatment methods and patient care.
• Product development and post-market surveillance by Hedera Dx as legally required under the In-Vitro Diagnostics Regulation.
• Compliance with legal obligations in reporting findings to health authorities when necessary.

Our legal basis for processing personal data is grounded in:

• Your explicit consent (Article 6(1)(a) GDPR) for the collection and processing of your data provided via the app. You are asked to give or withdraw this consent when you start using the app.
• Legitimate interest (Article 6(1)(f) GDPR and Article 9(2)(j) GDPR) for conducting scientific research to advance understanding of NSCLC.
• Legal obligations (Article 6(1)(c) GDPR and Article 9(2)(i) GDPR) for regulatory compliance, including safety monitoring and reporting.

6. How We Collect Data

We collect personal data through:

• Direct input: The information you provide in the app, such as questionnaire responses and treatment details.
• Cookies and trackers: These are used to collect non-personal device information for optimizing the app’s performance.
• Pseudonymized identifiers: Your study ID is used to link data across the registry without identifying you directly.

7. How We Use Your Personal Data

The data you provide is used for:

• Research purposes: To advance understanding of cancer and improve patient care.
• Product improvement: Hedera Dx uses pseudonymized data to refine its liquid biopsy products.
• Data sharing: Pseudonymized data may be shared with approved researchers and supervisory authorities for scientific purposes and further research.

8. Safety and Security Practices

We prioritize the safety and security of your personal data. We apply industry-standard security measures to prevent unauthorized access, disclosure, or loss of your information. Data is stored securely, and any personal identifiers are pseudonymized to maintain your privacy.

9. Data Retention

Your data will be stored for 10 years after the conclusion or termination of the study. After this period, it will be anonymized in compliance with GDPR regulations, ensuring that re-identification is no longer possible.

10. Your Rights Under GDPR

As a participant, you have the following rights:

• Withdraw consent: You can withdraw your consent at any time.
• Access your data: You can request a copy of your personal data.
• Correct inaccuracies: You can request corrections to any inaccurate information.
• Request deletion: You can request that your data be erased under certain conditions.
• Restrict processing: You may ask us to limit how we use your data in certain circumstances.
• Object to processing: You can object to the processing of your data for legitimate interest purposes.
• Data portability: You can request to transfer your data to another service provider.

To exercise these rights, please contact our data protection officer.

11. Updates to the Privacy Policy

We may update this privacy policy as needed to reflect changes in our practices or legal requirements. Any updates will be communicated through the app, and your continued use of the app after such updates will indicate your acceptance of the changes.

12. Complaints

If you are unsatisfied with how your data is handled, you can file a complaint with your local data protection authority. We encourage you to first contact your study doctor or the Data Protection Officer to resolve any concerns.

13. Contact Information

For any inquiries or concerns regarding your personal data or this privacy policy, please contact our Data Protection Officer or the relevant clinical site where you are receiving treatment.

By using the "myHedera" app, you acknowledge that you have read and understood this privacy policy and consent to the collection and processing of your personal data as described above.