For patients/participants in the wi.CARE+ platform
(platform for digital health and wellness)
Version and date: July 2023
Personal Data Processing Notice
(Articles 13, 14 of Regulation (EU) 2016/679)
The company under the name “WINGS ICT SOLUTIONS TECHNOLOGIES PLIROFORIKIS KAI EPIKOINONION SOCIETE ANONYME” and with the distinctive title “WINGS ICT SOLUTIONS S.A.” headquartered in Nea Smyrni, Attica, 189 Syngrou Avenue, P.O. Box 17121 (hereinafter the “Company”), addresses with responsibility and as a matter of primary importance the issues of personal data protection and privacy and complies with Regulation (EU) 2016/679 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter the “Regulation”) and the relevant Greek legislation.
In this context, we provide you with this Notice pursuant to Articles 13, 14 of the Regulation, in order to inform you about the way we collect and process your personal data in the context of your participation in the pilot program of remote patient monitoring through the health platform wi.CARE+ platform for digital health and wellness, a digital solution offered by our Company.
1. Data Controller
The Data Controller for the collection of your data and their processing is the Company, as defined above. This means that the Company determines the purposes and manner of processing your personal data in accordance with the Regulation and generally applicable law.
2. Sources of personal data collection
The Company generally collects your personal data, which is considered as a necessary condition for starting and ensuring a smooth relationship with you, directly from you and not from third party sources. Any failure on your part to provide such data could be a significant obstacle to the continuation of our relationship, if not a reason for its termination, and any incomplete information about your health status may put your health and life at risk.
3. Processing of personal data and legal bases
The table below sets out the purposes of the processing of personal data processed by the Company, the categories of such personal data, as well as the legal basis for their processing.
Purpose of processing | Categories of Personal Data | Legal Basis for Processing |
|---|---|---|
Registration and maintenance of a user account on the wi.CARE+ health platform website. | Personal information (full name), contact information (address, phone number and email address), date of birth, gender, nationality, height, weight, profile photo, username and password. name of the attending physician, medical conditions, medication. | Article 6, par. 1, point b) - processing is necessary for taking measures at the request of the data subject Article 9, par. 2, point h) - processing is necessary for the purposes of medical diagnosis |
Sending notifications in case of detection of abnormal values of the patient’s vital functions | Name of the attending physician, medical conditions, entry of vital signs (blood pressure, heart rate, oxygen saturation, weight, imaging tests, steps), medication. | Article 6, par. 1, point b) - the processing is necessary for the performance of the contract. Article 9, par. 2, point h) the processing is necessary for the purposes of medical diagnosis. |
Daily communication for the management of the digital platform | Personal data (full name), contact details (address, telephone number and email address), health data and vital signs registration | Article 6, par. 1, point c) - processing is necessary for compliance with a legal obligation Article 9, par. 2, point i) - processing is necessary for reasons of public interest in the field of public health by ensuring high standards of safety and quality of medical devices. |
4. Disclosure to third parties and Categories of recipients
Your personal data as described above may be disclosed to the internal competent departments of our Company and to third party health professionals using the wi.CARE+ digital solution. In addition, your personal data may also be disclosed to other partner institutions or organizations if this is deemed necessary in the context of the certification of the solution as a medical device by the competent public bodies, the clinical testing and evaluation of the wi.CARE+ platform. In any case, the Company will disclose where necessary the personal data in a lawful manner to ensure the universal protection of your personal data. The personal data we collect is stored within the European Union. The Company does not transfer your personal data to third parties, public or private bodies, nor to a third country or international organisation.
5. Security
The Company processes your personal data in a way that ensures their protection, taking all appropriate organizational and technical measures to ensure data security and protect them from accidental or unlawful destruction, accidental loss, alteration, unauthorized disclosure or access and any other form of unlawful processing
6. Subject rights
This section sets out your rights in relation to your personal data. These rights are subject to certain exceptions, reservations, or limitations. Please submit your requests responsibly. The Company will respond to you as soon as possible and in any event within one (1) month of receipt of the request. If the processing of your request is going to require more time, you will be informed accordingly. To exercise your rights, you may contact us by email at: dpo@wings-ict-solutions.eu. The Company will ensure the unimpeded exercise of the following rights:
6.1. The right to information/update
You have the right to request and receive clear, transparent, and easily understandable information about how we process your personal data, in accordance with the relevant policies and procedures of the Company.
6.2. The right of access
You have the right to access your personal data free of charge, in accordance with the Company’s policies and procedures from time to time, except in the following cases, where there may be a reasonable charge to cover the Company’s administrative costs:
• manifestly unfounded or excessive/repeated requests, or
• additional copies of the same information.
6.3. The right of rectification
You have the right to request the correction of your personal data if it is inaccurate or incomplete, in accordance with the Company’s policies and procedures from time to time.
6.4. The right of deletion
You have the right to request the deletion or removal of your personal data when it is no longer necessary for the purposes for which it was collected or there is no legitimate reason for its continued processing, in accordance with the Company’s policies and procedures. The right to erasure is not absolute, to the extent that there is a specific legal obligation or other legitimate reason for the Company to retain your personal data.
6.5. The right to restriction of processing
In certain cases, you have the right, in accordance with the Company’s policies and procedures, to restrict or remove further processing of your personal data. In cases where processing has been restricted, your personal data remains stored without further processing.
6.6. The right to data portability
You have the right to request the personal data concerning you that you have provided to us in a structured, commonly used and machine-readable format, as well as to transmit such data to another controller, in accordance with the Company’s policies and procedures from time to time.
6.7. The right to object
You have the right to object, at any time and on grounds relating to your situation, to the processing of your personal data, which is based on Article 6 para. 1(f) of the Regulation (processing for reasons of legitimate interest of the Company, based on this provision). In such a case, the Company as Controller shall no longer process the personal data unless it demonstrates compelling legitimate grounds for the processing which override the interests, rights, and freedoms of the data subject or for the establishment, exercise or defense of legal claims.
6.8 Rights relating to automated individual decision-making and profiling
The Company does not engage in automated individual decision-making, including profiling.
6.9. How to exercise your rights
The exercise of the aforementioned rights requires the submission of a written request to the company, in accordance with its policies and procedures. The Company reserves the right to respond no later than one month after receipt of the request, in accordance with the terms of the Regulation and its policies and procedures.
7. Retention period of personal data
For each category of personal data, the Company determines the retention period of personal data in accordance with the provisions of the law for each category of personal data and its policies and procedures.
8. Data Protection Officer for personal data issues
For any issue related to the processing of personal data and this notice, please contact the Data Protection Officer appointed by the Company:
Protection Officer | Alexandros Katsantonis |
|---|---|
Phone Nymber | +30 215 501155 |
E-mail: | dpo@wings-ict-solutions.eu |
9. Communication with the supervisory authority
For further information and advice on your rights or to lodge a complaint, you can contact the Hellenic Data Protection Authority, the Greek supervisory authority: Personal Data Protection Authority, Offices: 1-3 Kifissias Avenue, P.O. Box 115 23, Athens, Greece, Phone: +30-210 6475600, Fax: +30-210 6475628, E-mail: contact@dpa.gr.
10. Revisions to this Notice
We aim to continually review and update this Notice in order to comply with personal data legislation and new developments. Any updates to this Notice will be communicated to you immediately