a. What is personal data? 

 “Personal data” means any information relating to an identified or identifiable natural person, known as ‘Data Subject’, who can be identified directly or indirectly; it may include name, address, gender, email address, phone number, IP address, location data, cookies, call records and similar information. It may also include “special categories of personal data” such as racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a Data Subject, data concerning health or data concerning a natural person’s sexual orientation. 

b. What Personal data does Qure collect and process? 

Qure receives, processes and stores two distinct sets of personal data.  We will process the following personal data on the Services: 

1. User profiles

• First and Last Name 
• E-mail address at the time of sign up 

2. Technical usage data

• such as the URL you are accessing the Services from, your IP address, unique device ID, network and computer performance, browser type, language and identifying information and operating system;  
• information about your use of the Services, such as what you viewed or searched for; page response times, download errors, length of visits to certain pages, page interaction information (such as scrolling, clicks and mouse-overs), consultation length(s), recurrence of visits and other interaction information, methods used to browse away from the page. 

3. A third set of personal data is processed using the QureApp, which you as a User will upload the data on the platform and Qure will act as Data Processor on behalf as of you as Data Controller for this data:

• Anonymised patient case information pseudonymized DICOM images including embedded metadata;  
• content that you post, upload and/or contribute to the Services; 

For the data listed in clause II (b) (3) above, where you as a User of the Services will act as Data Controller and Qure  as provider of Services, will act as a Data Processor, you hereby acknowledge and agree for Data Processing Agreement which is effective from the date of your first use of Services. The Data Processing Agreement outlines what kind of processing we are instructed to perform on your behalf regarding Personal data pertaining to Data Subjects where you are the Data Controller. 

Information about third parties should only be provided to us if you have demonstrable permission and consent of Data Subjects i.e., your patients, to do so or if the information is available in the public domain. You shall be solely responsible for receiving all informed, written, explicit or implicit consents as required under applicable laws, from the Data Subjects i.e., your patients or similar data owners. Your use of Services is deemed that such consents have been duly received by you and will be available upon request for Qure to audit. We will rely on you to provide information which is accurate, complete and up to date and you agree to ensure this. 

For Individuals accessing QureApp to upload their DICOMs, Qure will act as Data controller as per applicable laws.  

Qure will process the Personal data sets described above for the following purposes:  

• To enable you to verify your account, to administer your account, to enable and provide the Services and integration with third party services, and to provide, personalize and improve your experience with the Services, and to otherwise provide the Services according to the Terms of Service;  

• to send you alerts or messages by email or otherwise, including to provide you with marketing of our and our related parties’ products and services; 
• to inform you about updates of the Services or the terms and conditions of Services; 
• to improve and develop the Services or new services and to analyse your use of the Services; 
• to ensure the technical functioning of the Services and to prevent the use of the Services in breach of the Terms (including the Universal Terms and any other terms in relation to Application or Services); 
• to enforce the Terms and any additional Terms (including the Universal Terms and any other terms in relation to Application or Services), including to protect our rights, property and safety and the rights, property and safety of third parties if necessary;  

• to fulfil our obligations as Data Controller and Data Processor; 
• to respect and fulfil our obligations in regards to the Rights of the Data Subject; 
• to respond to any queries you raise with us and to provide customer support; and  
• to fulfil requirements by law (see clause VIII below).  

Qure processes Personal Data only where a valid lawful basis exists under applicable data protection laws. Depending on the nature of the Personal Data and the purpose of processing, the lawful basis relied upon by Qure is set out below. 

1. (i) Processing Necessary for Performance of a Contract

   Qure processes the following categories of Personal Data where such processing is necessary for the performance of a contract to which you are a party, or in order to take steps at your request prior to entering into such a contract:

   • User profile information, including first and last name and e-mail address collected at the time of registration;
   • Account and access management data required to verify your account, administer user access, enable use of the Services, and provide customer support;
   • Service-related communications, including notifications regarding updates to the Services or changes to applicable terms.

   The provision of such Personal Data is necessary to enter into and maintain the contractual relationship between you and Qure. Without this information, Qure will be unable to provide the Services.

2. (ii) Processing Based on Legitimate Interests

   Qure processes certain Personal Data on the basis of its legitimate interests, provided that such interests are not overridden by your rights and freedoms. These legitimate interests include ensuring the security, stability, and improvement of the Services.

   Processing conducted on this basis includes:

   • Technical usage data, such as IP addresses, device identifiers, browser type, operating system, language preferences, log files, and interaction data;
   • Analytics and usage data used to monitor performance, diagnose technical issues, prevent fraud, ensure IT security, and improve or develop existing or new Services;
   • Enforcement-related processing, where necessary to detect, prevent, or investigate misuse of the Services or breaches of the applicable Terms.

   Qure has assessed that such processing is proportionate, limited to what is necessary, and subject to appropriate safeguards.

3. (iii) Processing Based on Consent

   Qure processes Personal Data on the basis of your consent where required by applicable law, including but not limited to:

   • Direct marketing communications, where such communications are not otherwise permitted under applicable law without consent;
   • Any other processing activities for which consent is expressly obtained at the time of collection or through the Services.

   Where processing is based on consent, you may withdraw your consent at any time in accordance with the instructions provided in the relevant communication or within the Services. Withdrawal of consent does not affect the lawfulness of processing carried out prior to such withdrawal.

4. (iv) Processing to Comply with Legal Obligations

   Qure may process Personal Data where such processing is necessary to comply with legal or regulatory obligations, including obligations relating to record keeping, lawful disclosures to public authorities, and responses to valid legal requests.

5. (v) Processing as Data Processor on Behalf of Users

   Where Personal Data is uploaded or otherwise provided to the QureApp by Users acting in a professional or organisational capacity (including, without limitation, healthcare providers, institutions, or authorised practitioners), such Users shall act as Data Controllers, as they determine the purposes and means of processing Personal Data relating to Data Subjects (for example, patients). In such cases:

   • Qure acts solely as a Data Processor and processes Personal Data only on the documented instructions of the User acting as Data Controller;
   • the lawful basis for processing such Personal Data is determined by the User acting as Data Controller; and
   • Qure’s processing is governed by the applicable Data Processing Agreement, which forms part of the contractual arrangement between Qure and the User.

   The User acting as Data Controller is responsible for ensuring compliance with applicable data protection laws, including providing appropriate notices to Data Subjects and obtaining any required consents or other lawful bases for processing.

Retention periods are determined based on the type of Personal Data, the purpose of processing, and applicable legal or regulatory requirements, in accordance with Qure’s internal data retention and deletion policies.  

In particular:  

Account and user profile data is retained for as long as the user has an active profile on the Services. users who have not used our Services will have all personal data deleted after 1 year of inactivity on the Services. 

If you agree to be added to our mailing list, we will keep your personal information for that purpose unless and until you tell us that you want to unsubscribe or be removed from the list. If you advise that you do not want to be added to our mailing list or you ask to be removed, we will delete your Personal data (aside from keeping a record that you have asked us not to send you marketing information). 

The QureApp and the Services provided under it are not directed at, marketed to, nor intended for, children under 18 years of age. The Website does not knowingly collect or solicit information from anyone under the age of 18 or allow anyone under the age of 18 to sign up for the Service. In the event that you learn that you have gathered personal information from anyone under the age of 18 without the consent of a parent or guardian, you will delete that information as soon as possible. 

You are required under the Children’s Online Privacy Protection Act (“COPPA”) as well as the GDPR and other Personal Data Protection laws (as those may apply) to obtain verifiable parental consent (or from the child’s legal representative) in order to collect, use or disclose Personal Data pertaining to that child. 

If you are a parent or guardian of a person under the age of 18 and you become aware of that the child has provided personal data to us without your consent, please contact dpo@qure.ai  to exercise your access, rectification, erasure, limiting of processing and objection rights. 

The importance of security for Personal data is of great concern to us. At Qure, we have gone to great lengths to manage the security and integrity of the Services and to ensure that we use best–in-class services when providing secure transmission of information from your device. Personal Data collected via the Services is stored in secure environments that are not available or accessible to the public; only those duly authorised people, officers, employees or agents of Qure who need access to your information in order to do their jobs are allowed access.  

Anyone who violates our privacy or security policies is subject to disciplinary action, including possible termination of their contract with Qure and civil and/or criminal prosecution. Qure uses the latest technologies to ensure utmost security, including utilising several layers of firewall security and encryption of Personal data to ensure the highest level of security. As a result, while we strive to protect your Personal data, you acknowledge that: 

(a) there are security and privacy limitations of the Internet which are beyond our control; 

(b) the security, integrity and privacy of any and all information and data exchanged between you and us through this Website cannot be guaranteed; and 

(c) any such information and data may be viewed or tampered with in transit by a third party. 

To exercise your rights, or if you have any questions or complaints regarding our processing of your personal data, you may contact Data Protection Officer (DPO), Mr.Vivek Anand at dpo@qure.ai. In your letter/email please state your full name, your username (if you are a user) and which institution you are linked to. Note that you should sign the request to receive information about the processing of your personal data yourself. 

If we make changes to this Privacy Notice, we will notify you by posting a copy of the updated policy on our Services prior to any change becoming effective. We will post a copy of the updated policy on our Services prior to any change becoming effective. If your consent is required due to the changes, we will provide you additional prominent notice as appropriate under the circumstances and ask for your consent in accordance with applicable law.