a. What is personal data? 

 “Personal data” means any information relating to an identified or identifiable natural person, known as ‘Data Subject’/ ‘Data Principal’ (these terms maybe used interchangeably throughout the document), who can be identified directly or indirectly; it may include name, address, gender, email address, phone number, IP address, location data, cookies, call records and similar information. It may also include “special categories of personal data” such as racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a Data Subject, data concerning health or data concerning a natural person’s sexual orientation.  

b. What Personal data does Qure collect and process? 

Qure receives, processes and stores two distinct sets of personal data.  We will process the following personal data on the Services: 

1. User profiles

• First and Last Name 
• E-mail address at the time of sign up 

2. Technical usage data

• such as the URL you are accessing the Services from, your IP address, unique device ID, network and computer performance, browser type, language and identifying information and operating system;  
• information about your use of the Services, such as what you viewed or searched for; page response times, download errors, length of visits to certain pages, page interaction information (such as scrolling, clicks and mouse-overs), consultation length(s), recurrence of visits and other interaction information, methods used to browse away from the page. 
• Inquiry and support data: name, email address, and the content of any inquiry or support request submitted to us.  
• Marketing and business contact data: name, work email address, job title, company name, and marketing preferences, where you have explicitly opted into communications from us. 
• Patient scan data (Processor role only): de-identified DICOM images and associated embedded metadata uploaded to QureApp by users acting as Data Fiduciaries on behalf of Partner Medical Centers. In this context, Qure acts exclusively as a Data Processor under the applicable Customer Data Processing Agreement. Qure does not independently determine the purpose or means of processing this data.Please note: Where you provide us with personal data relating to a third party (such as patient data), you represent and warrant that you have obtained all necessary consents and authorizations from the relevant Data Principals, in the manner required by applicable law, before providing that data to us. We will rely on the accuracy, completeness, and lawfulness of the data you provide. 

For the data listed in clause II (b) (3) above, where you as a User of the Services will act as Data Controller or Data Fiduciary (these terms maybe used interchangeably throughput the document) and Qure as provider of Services, will act as a Data Processor, you hereby acknowledge and agree for Data Processing Agreement which is effective from the date of your first use of Services. The Data Processing Agreement outlines what kind of processing we are instructed to perform on your behalf regarding Personal data pertaining to Data Subjects where you are the Data Controller.  

Information about third parties should only be provided to us if you have demonstrable permission and consent of Data Subjects i.e., your patients, to do so or if the information is available in the public domain. You shall be solely responsible for receiving all informed, written, explicit or implicit consents as required under applicable laws, from the Data Subjects i.e., your patients or similar data owners. Your use of Services is deemed that such consents have been duly received by you and will be available upon request for Qure to audit. We will rely on you to provide information which is accurate, complete and up to date and you agree to ensure this.  

For Individuals accessing QureApp to upload their DICOMs, Qure will act as Data controller as per applicable laws.   

Qure will process the Personal data sets described above for the following purposes:  

• To enable you to verify your account, to administer your account, to enable and provide the Services and integration with third party services, and to provide, personalize and improve your experience with the Services, and to otherwise provide the Services according to the Terms of Service;  

• to send you alerts or messages by email or otherwise, including to provide you with marketing of our and our related parties’ products and services; 
• to inform you about updates of the Services or the terms and conditions of Services; 
• to improve and develop the Services or new services and to analyse your use of the Services; 
• to ensure the technical functioning of the Services and to prevent the use of the Services in breach of the Terms (including the Universal Terms and any other terms in relation to Application or Services); 
• to enforce the Terms and any additional Terms (including the Universal Terms and any other terms in relation to Application or Services), including to protect our rights, property and safety and the rights, property and safety of third parties if necessary;  

• to fulfil our obligations as Data Controller and Data Processor; 
• to respect and fulfil our obligations in regards to the Rights of the Data Subject; 
• to respond to any queries you raise with us and to provide customer support; and  
• to fulfil requirements by law (see clause VIII below).  

Qure processes Personal Data only where a valid lawful basis exists under applicable data protection laws. Depending on the nature of the Personal Data and the purpose of processing, the lawful basis relied upon by Qure is set out below. 

1. (i) Processing Necessary for Performance of a Contract

   Qure processes the following categories of Personal Data where such processing is necessary for the performance of a contract to which you are a party, or in order to take steps at your request prior to entering into such a contract:

   • User profile information, including first and last name and e-mail address collected at the time of registration;
   • Account and access management data required to verify your account, administer user access, enable use of the Services, and provide customer support;
   • Service-related communications, including notifications regarding updates to the Services or changes to applicable terms.

   The provision of such Personal Data is necessary to enter into and maintain the contractual relationship between you and Qure. Without this information, Qure will be unable to provide the Services.

2. (ii) Processing Based on Legitimate Interests

   Qure processes certain Personal Data on the basis of its legitimate interests, provided that such interests are not overridden by your rights and freedoms. These legitimate interests include ensuring the security, stability, and improvement of the Services.

   Processing conducted on this basis includes:

   • Technical usage data, such as IP addresses, device identifiers, browser type, operating system, language preferences, log files, and interaction data;
   • Analytics and usage data used to monitor performance, diagnose technical issues, prevent fraud, ensure IT security, and improve or develop existing or new Services;
   • Enforcement-related processing, where necessary to detect, prevent, or investigate misuse of the Services or breaches of the applicable Terms.

   Qure has assessed that such processing is proportionate, limited to what is necessary, and subject to appropriate safeguards.

3. (iii) Processing Based on Consent

   Qure processes Personal Data on the basis of your consent where required by applicable law, including but not limited to:

   • Direct marketing communications, where such communications are not otherwise permitted under applicable law without consent;
   • Any other processing activities for which consent is expressly obtained at the time of collection or through the Services.

   Where processing is based on consent, you may withdraw your consent at any time in accordance with the instructions provided in the relevant communication or within the Services. Withdrawal of consent does not affect the lawfulness of processing carried out prior to such withdrawal.

4. (iv) Processing to Comply with Legal Obligations

   Qure may process Personal Data where such processing is necessary to comply with legal or regulatory obligations, including obligations relating to record keeping, lawful disclosures to public authorities, and responses to valid legal requests.

5. (v) Processing as Data Processor on Behalf of Users

   Where Personal Data is uploaded or otherwise provided to the QureApp by Users acting in a professional or organisational capacity (including, without limitation, healthcare providers, institutions, or authorised practitioners), such Users shall act as Data Controllers, as they determine the purposes and means of processing Personal Data relating to Data Subjects (for example, patients). In such cases:

   • Qure acts solely as a Data Processor and processes Personal Data only on the documented instructions of the User acting as Data Controller;
   • the lawful basis for processing such Personal Data is determined by the User acting as Data Controller; and
   • Qure’s processing is governed by the applicable Data Processing Agreement, which forms part of the contractual arrangement between Qure and the User.

   The User acting as Data Controller is responsible for ensuring compliance with applicable data protection laws, including providing appropriate notices to Data Subjects and obtaining any required consents or other lawful bases for processing.

We use cookies of the following categories: .

• Basic Operations – these cookies are essential for proper functioning of our Website and for you to be able to use some important features on our website, such as logging in, navigation on the website and using certain other basic features of the website. In absence of these cookies, certain services may not be available.

• Content Personalization – These cookies collect information about how visitors use our Website, such as which pages are frequently visited and follow user action. The data collected is aggregated and anonymous, allowing us to improve the performance and functionality of our Website.

• Site Optimization – are used to enhance the performance of websites as without them certain functions of the website may not be available as these cookies make using our Website more convenient and makes providing more personalized features possible. For instance, these may remember your name, e-mail or other such details provided by you to ensure that you do not have to re-enter this information next time.

• Ad Personalization – these cookies are used to deliver advertisements that are relevant to you and to your interests. In addition, they are used to limit the number of times you see an advertisement. They are usually placed to the website by advertising networks with the website operator’s permission. These cookies remember that you have visited a website and this information is shared with other organizations such as advertisers. Often targeting or advertising cookies will be linked to site functionality provided by the other organization.

• First party cookies: First-party cookies are the advertising cookies collected by the website a user visits. The primary purpose of such cookies is to track user behaviour and personalize their experiences accordingly.

• Third party cookies: We may allow third-party service providers to place cookies on our Website to enhance its functionality or provide additional services. These cookies are subject to the respective privacy policies of these third-party providers. We do not have control over the information collected by these cookies.

• Some of the cookies used by us are necessary for the functionality of the website to store the consent of the users for dropping advertising and other cookies. We store cookies for varying durations depending on their purpose:

• Session Cookies: These are temporary cookies that remain on your device only for the duration of your browsing session. They are deleted once you close your browser.

• Persistent Cookies: These cookies remain on your device for a specified period or until you manually delete them. They help us remember your preferences for future visits. The specific expiration/retention period for each cookie is detailed in the Cookie Category List below.