Ab3 Medical

Mobile App Terms of Use & Privacy Acceptance

Welcome to the AB3 Medical Limited App (referred to below as the App).

The App provides a secure platform which holds, and allows you to access, your medical information. To make the App and related Service available to you, AB3 Medical Limited (AB3) uses certain personal data as explained in this Privacy Policy.

Note: The medical data held in the App is inputted by you and your medical team. AB3 does not routinely access or use this data except where strictly necessary as explained in this Privacy Policy. The personal data we refer to in this Privacy Policy explains how the other types of personal data which we hold are used.

Under data protection law, we must provide you with certain details about who we are, how we use personal data, for what purposes and your personal data rights. This information is provided in this Privacy Policy which you should read carefully.

The App is NOT to be used by minors, i.e. anyone under the age of 18.

Before creating your secure patient account, please indicate whether you consent to us processing your personal data as described in this Privacy Policy. Once you have provided consent by selecting “YES”, you may change your mind and withdraw consent at any time by contacting us at contact@ab3medical.com, but that will not affect the lawfulness of any use of your data before your consent is withdrawn.

1. Important information – what the App is for and who we are

This Privacy Policy together with our Terms of Use applies to your use of:

The AB3 Medical Limited (AB3/we/us/our) mobile application software (App), hosted at www.ab3medical.com, once you have created your secure patient account and downloaded a copy of the App onto your mobile phone or other device (Device).
Any of the services accessible through the App (Services).

This policy also covers our use of personal data which we may collect through our website at www.ab3medical.com, such as when you use our contact form.

This policy explains how we use the personal data we collect. Please read it carefully to understand our practices regarding your personal data and how we will treat it.

What the App is for:

AB3 Medical Limited makes available the App and related Service. The App and Service are intended for use by healthcare patients (you/your) and your medical professionals only.

The App provides a platform into which your medical professionals, who you may allow to access the App, can include personal data about your medical condition and treatment. To create your secure patient account and use the App, you (or your medical team on your behalf) will need to provide certain information, which may include your name, date of birth, next of kin and certain contact details. This information is used to register you as a verified patient within the AB3 platform, to ensure your medical record is correctly associated with your identity, and to protect your account from unauthorised access. Your medical professionals will provide further information about what information they need from you.

AB3 provides the App and Service only. It does not upload or otherwise include, nor does it routinely access or use, any medical detail or other personal data stored by you and your medical professional team within your App records, except where strictly necessary to provide technical support, maintain the Service, comply with legal obligations, or where authorised by you or your healthcare provider, as explained in this Privacy Policy. All such data is reliant only on what you and your medical professionals may include. AB3 may, however, update certain details as requested by your medical team in circumstances where that medical team changes. Any such changes will be administrative only in nature and the actual content of any substantive changes will be determined by your medical team and not by AB3.

Your AB3 account and your clinical records are distinct. Your AB3 account is the secure login and profile which gives you access to the App. Clinical records about your care are created and maintained by your healthcare professionals and the healthcare organisations they work for, and may also be held by those organisations in their own systems in accordance with their own legal and professional obligations. This distinction matters in particular for data retention and account deletion (see sections 12 and 13).

2. Our Contact Details

Our contact details are:

AB3 Medical Limited

Email: contact@ab3medical.com

We keep our Privacy Policy under review and it may change from time to time.

3. The data we collect about you

In data protection legislation, certain types of personal data are classed as “Special Category” personal data, to which particular rules apply. Special Category data includes data about race and ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinion, and trade union membership. It also includes information about physical and mental health.

Our stance on your medical information

The App is aimed at helping you and your medical team to manage your medical information, but it is important to remember that AB3 does not routinely access or use your medical information, except where strictly necessary to provide technical support, maintain the Service, comply with legal obligations, or where authorised by you or your healthcare provider. Our business is to provide software and Services related to that software only. We do not provide medical advice or similar, and we never use your medical information for our own commercial purposes.

We only use other types of personal data in so far as they are relevant to the Service which we provide. The personal data which we collect includes the following:

● Identity DataIncludes first name, last name, former names, username or similar identifier, plus title and date of birth. This data is used to register and verify you as a patient within the AB3 platform. Date of birth is collected because it forms part of the core demographic information used to verify your identity, distinguish you from patients with similar names, accurately match you to your medical record, and help protect against patient identification errors.
● Contact DataIncludes address information, email address and telephone numbers. Telephone numbers are collected so that authorised healthcare organisations and medical professionals using the AB3 platform can contact you where necessary in relation to your care, appointments, treatment or other healthcare-related communications. Your email address is also used for account authentication, security notifications and Service communications.
● Financial DataIncludes confirmation about payment of fees, where relevant. It may be provided by a company, association or other body to which you belong, which may pay us to make the App available to you. This may not always be relevant.
● Device DataMay include information about the type of Device you use, a unique device identifier, the mobile phone number used by your Device, details of your mobile operating system and the type of mobile browser you use.
● Usage DataIncludes detail of your use of our App or website, detail of resources you access when using them, traffic data and communication data.
● Profile DataIncludes information about your interests, preferences, feedback and responses to any surveys which we may run.
● Marketing and Communications DataIncludes your preferences in receiving marketing from us and our third parties and your communication preferences. This relates to marketing activity which we may undertake from time to time.
● Content Data (Special Category Data)This is the personal data which your medical team (and you) may upload to the App and use our Service to access. It includes information relating to health conditions, illnesses, injury, treatment, details of your medical team and other information usually associated with your medical and fitness record, such as letters, results and voicenotes from your medical professional. This is Special Category data. AB3 does not routinely access or use Content Data except where strictly necessary to provide technical support, maintain the Service, comply with legal obligations, or where authorised by you or your healthcare provider, as explained in this Privacy Policy. We never use Content Data for our own commercial purposes.

4. How is your personal data collected and from where?

We will collect data about you in the following ways:

Information you give us

This may include Identity, Contact, Financial, Marketing and Communications Data you consent to giving us by creating your secure patient account and registering as a user, or when you report a problem with the App or our Service. If you contact us, including if you do so via our website, we will keep a record of that correspondence. It includes information you may provide when you get in touch for other reasons, such as with queries on how the App works or login problems. We class information as provided by you if it is provided on your behalf, for example by an organisation of which you are a member or by your medical team.

Information we collect about you and your Device

We may automatically collect personal data including Device and Usage Data. We collect this data using cookies.

Information we receive from third parties

Most users come to us through a company they work for or through membership of an organisation. In those cases, we may receive information from that entity. From time to time, we might also receive personal data from other third party sources.

5. Cookies

We use cookies when you use the App and our Service. See our Cookie Policy for more information.

6. How we use your personal data – general

We will only use your personal data as the law allows. The law sets out different bases which can be relied on when personal data is used or “processed”. Most commonly, we use your personal data where:

You have consented.
We need to perform a contract which we will or have entered with you, including performing in accordance with the Terms of Use for our App and Services.
It is necessary for our Legitimate Interests (or those of a third party) and your interests and fundamental rights do not override those legitimate interests. More information is below.
We need to comply with a legal or regulatory obligation.

7. Purposes for which we will use your personal data – more detail

We state below how we use personal data and the basis we rely on for each purpose of use. We identify our legitimate interests where relevant. We may use personal data for more than one lawful basis depending on the circumstances. It is useful to be aware that:

Consent

Consent means using your personal data where you have indicated your agreement by a statement or opt-in to the use for a specific purpose. Consent is valid if freely given, specific, informed and unambiguous. You can withdraw your consent at any time by contacting us.

Legitimate Interest

Legitimate Interest means our interest in conducting our business, including to give you a good Service and user experience. We consider and balance potential impacts on your rights before we process personal data for our legitimate interests, and we don't use personal data where our interests are overridden by the impact on you (unless you agree or we are required or permitted to do so by law).

Purpose 1: To create your secure patient account and register you as a verified patient

We use your personal data to allow you to create your secure patient account, install the App and become a registered App user. Registration involves verifying your identity so that we can register you as a verified patient within the AB3 platform and ensure your medical record is correctly associated with your identity. We retain data so that we know only authorised, registered users are accessing our App.

Authentication and account security: we use your registration information to authenticate your account, prevent unauthorised access and protect the confidentiality of your medical information. This includes verifying your login credentials, managing authentication sessions and helping to detect and prevent suspicious account activity.

Types of Personal Data: Data will usually include Identity Data, Contact Data, Device Data and Usage Data.

Lawful Basis for Processing: It is in our legitimate interests to ensure the App is made available to authorised, verified users, to protect the security and confidentiality of patient accounts, to communicate with you, to ensure we administer your App account properly and for the operation of our business.

Purpose 2: To continue to make the App and Service available to you

We use your personal data to make the Service available in accordance with our Terms of Use. This includes administration of our relationship with you as an App user. It may involve using your data to liaise with any organisation involved in the administration of your account, such as if we receive payment of subscription fees through your employer or a membership organisation which you belong to.

A feature of the App and Service is the transferability of your records to a new team when you wish. As the Content Data is on the App, you decide who can access that Content Data, including if you move to a new medical team. In that way, your Content Data moves when you move, but we will not access it for that purpose. We may, though, make administrative Service updates on the instruction of your medical team, but we do not make decisions about such changes and only follow instructions from your medical team.

Types of Personal Data: This usually includes Identity Data, Contact Data, some Financial Data (if we keep a record of whether fees for your use of the App have been paid), Device Data and Usage Data. It may include data about the identity of your medical team who may instruct any administrative functions we implement.

Lawful Basis for Processing: It is in our legitimate interests to ensure that our authorised App users have appropriate continued access and Service use. This also includes ensuring that fees have been paid, where relevant. Where we use personal data for this purpose in accordance with our Terms of Use, we also process personal data on the basis of it being for the performance of those contract terms.

Purpose 3: Marketing activity

From time to time, we may introduce content which promotes either AB3's business and services or products and services offered by selected third parties who we may choose to run a marketing campaign with. We may use your personal data to bring marketing to your attention and run promotions and advertising content. We also use personal data to measure and analyse the effectiveness of the advertising you see and so that we can monitor marketing and usage trends which may also be relevant to the improvement of our App.

Types of Personal Data: For this purpose we may use Identity Data, Contact Data, Profile Data and Marketing and Communications Data. It may also include Usage Data and Device Data.

Lawful Basis for Processing: It is in our legitimate interests to use personal data for marketing and promoting our business and the services we and our selected partners offer, and for developing our profile, understanding our user base and informing our business strategy in order to grow and develop our business and offering. We will only send direct marketing communications by email or text if we have your consent or where the law allows us to. You have the right to unsubscribe from marketing communications at any time by contacting us. We never use Content Data for marketing purposes.

Purpose 4: To manage technical issues relating to the App or Services

We may occasionally change the App, such as to add new functionality or to roll out software updates. This helps ensure you get the best from the App and ensures we can properly maintain it. We may push out notifications from time to time and may use data for troubleshooting, system testing and analysis.

Very occasionally, it may be that to resolve technical issues, our technical team will have visibility of your Content Data, but only incidentally, such as when we need to access a screen or function to resolve a technical issue. We will only ever have such access with your express permission, which you will be asked for at the time of the relevant access, or where otherwise strictly necessary to comply with a legal obligation.

Types of Personal Data: For this purpose, we usually use Identity Data, Contact Data, Device Data and Usage Data. In very rare circumstances, we may access Content Data for this purpose as explained above.

Lawful Basis for Processing: It is in our legitimate interests to ensure that our App properly performs and to ensure that users do what is required for proper access to the App and Services. This is also in our legitimate interests for running our business and the provision of administration, IT services and IT security. Where we agree to do something in our Terms of Use, we may also use personal data for these purposes where necessary for the performance of those contract terms. Where we access Content Data for this purpose, we will only do so with your consent as explained above, or where strictly necessary to comply with a legal obligation.

Purpose 5: To deal with general enquiries or comments you submit to us

We will use personal data when you contact us with an enquiry or comment. For example, you may use the contact form on our website to ask us a question, or you might simply email a query to us.

Types of Personal Data: We mainly use Identity Data and Contact Data for this purpose, to deal with your enquiry, contact you and respond. Depending on the enquiry type, it may also include Device Data or Financial Data, for example.

Lawful Basis for Processing: It is in our legitimate interests to answer queries and correspond with our users and potential users, for the proper running of our business.

8. Disclosures of your personal data

We use external service providers to perform certain services on our behalf, including to fulfil those purposes referred to above. This means that some personal data may be disclosed to our carefully selected contractors, such as IT service and hosting providers, professional advisors, insurers and consultants. We may also disclose certain personal data to the company, organisation or other body of which you are an employee, member or similar, and who we liaise with to make this App and our Service available, and in some cases, to regulatory bodies.

In the future, this may also include third parties to whom we may choose to sell, transfer or merge parts of our business or our assets. If a change happens to our business, a new owner may use your personal data in the same way as set out in this policy for business continuity.

This does not involve the disclosure of any of your Content Data to any person except with your consent, or where strictly necessary to comply with a legal obligation, as explained in this policy.

9. International transfers

We do not transfer your personal data outside the UK.

If you use the App outside the UK, that use is a decision for you and will not affect how we treat and use the personal data in accordance with this policy. We will, where requested by you or your medical team, allow access to the App and Service overseas, but any transfer of or access to Content Data overseas is a matter for you and your medical team. Any administrative changes we make to the App in those circumstances are facilitated from the UK, and the personal data we use for our own purposes as outlined in this policy remains in the UK.

10. Third party links

We provide links to websites of partners, advertisers and affiliates, such as through the tools section on the App. This may provide access to websites of third-party nutrition providers, recovery garment providers and other health resources. Such websites, and services accessible through them, may have their own privacy policies and collect data for their own purposes, for which we do not accept any responsibility. We suggest you check those policies before submitting any personal data to those websites or for other services.

11. Data security

The information you provide to us is stored on our secure servers or those of our third-party providers with whom we have a contract. You are responsible for keeping any passwords used to access our App and Service confidential and you should not share them with anyone.

We use your registration information to authenticate your account, prevent unauthorised access and protect the confidentiality of your medical information. Access to your account is protected by authentication controls, and we operate procedures and security features to try to prevent personal data from being accidentally lost, used or accessed in an unauthorised way. We have a suite of security measures which we use to help protect against typical security threats, which operate on a layered basis, such as through personnel training and penetration testing. We have procedures to deal with any suspected personal data breach and will notify you and any applicable regulator when legally required.

12. Data retention

We will retain personal details for as long as we have a business need. Data retention periods vary according to our uses of your data and the reasons for retaining it. For example, we keep certain personal data pertaining to our transactional relationships for at least six years for tax purposes. Other information, such as personal data for marketing, is periodically reviewed and is used in accordance with your preferences and for as long as we believe it is relevant for sending information we think is of interest to you.

Your use of the App and the Content Data is at your discretion and that of your medical team. Content Data is not controlled or used by us and you may retain that Content Data in the App for as long as the App is available to you.

Clinical records held by healthcare organisations: healthcare providers and organisations using the AB3 platform may be subject to statutory or professional record retention obligations which require certain clinical records to be retained even where an App account has been closed or deleted. Those records are controlled by the relevant healthcare organisation, not by AB3, and are retained in accordance with that organisation's own legal and professional obligations.

We may anonymise certain personal data (so it is no longer associated with you) for research or statistical purposes, which we may use on an ongoing basis without further notice to you.

If you cease to use the App or where fees due are not paid to us (including from a relevant third party), we may treat the account as expired and you may not be able to continue to use the App or any related Service. This may mean, without limiting our other rights to suspend or remove use of the App, that your medical team cannot add any new Content Data or other information to the App.

13. Account deletion

You may permanently delete your AB3 account at any time by using the Delete Account option available within the App settings, or by contacting us at contact@ab3medical.com.

Deleting your account will:

permanently remove your login credentials;
terminate your access to the App and Service;
revoke active authentication sessions; and
remove personal profile information which AB3 no longer requires to provide the Service.

Certain information may be retained following account deletion where we are legally or professionally required to do so. This includes, for example, transactional records which we must keep for tax purposes, and information forming part of healthcare records maintained by healthcare providers or organisations using the AB3 platform.

Where clinical records have been created by your healthcare professionals, those records may continue to be retained by the relevant healthcare organisation in accordance with applicable healthcare record retention requirements. Deleting your AB3 account does not delete clinical records held by your healthcare organisation; any request relating to those records should be directed to the relevant healthcare provider.

If we retain any information following account deletion, we will do so only where required by law, regulation or patient safety obligations, or for the establishment, exercise or defence of legal claims.

Once your account has been deleted, you will no longer be able to access the App unless a new account is created.

14. Updating your information

It is important that the personal data we hold about you to administer our relationship with you is accurate and current. Please keep us informed if your personal data changes during our relationship with you.

15. Your legal rights

In certain circumstances you have the following rights under data protection laws. You have the right to:

● Request accessTo your personal data (known as a “data subject access request”). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.
● Request correctionOf the personal data that we hold about you. This enables you to have any incomplete or inaccurate data corrected, though we may need to verify the accuracy of the new data you provide to us.
● Request erasureOf your personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to have it. You can also ask us to delete or remove your personal data where you successfully exercise your right to object to processing, where we may have processed your data unlawfully or where we are required to erase your personal data to comply with local law. We may not always be able to comply with your request of erasure for specific legal reasons, which will be notified to you, if applicable, at the time of your request.
● Object to processingOf your personal data where we are relying on a legitimate interest (or that of a third party) and you wish to object to processing on this ground as you feel it impacts your fundamental rights and freedoms. You also have the right to object where we process personal data for direct marketing purposes. We may demonstrate that we have compelling legitimate grounds to process your data which override your rights and freedoms.
● Request restriction of processing
Of your personal data, which means you can ask us to suspend processing of your personal data in the following scenarios:
1. if you want us to establish the data's accuracy;
2. where our use of the data is unlawful but you do not want us to erase it;
3. where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or
4. you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.
● Request the transferOf your personal data to you or a third party. We will provide to you, or your chosen third party, your personal data in a structured, commonly used, machine-readable format. This right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.
● Withdraw consent at any timeWhere we are relying on consent to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw consent. If you withdraw consent, we may not be able to provide certain services to you and we will advise you if that is the case at the time you withdraw consent.

You can exercise these rights by contacting us on the details stated at the start of this policy.

You will not have to pay a fee to access your personal data or to exercise any of the other rights, but we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. We could refuse to comply with your request in these circumstances. We may need to request information from you to help us confirm your identity and ensure your right to exercise any of these rights. This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response. We usually respond within one month.

You have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK regulator for data protection issues (www.ico.org.uk). We would, however, appreciate the chance to deal with your concerns before you approach the ICO, so please contact us in the first instance.