Data privacy app

Status: October 2021

As Oviva AG and operator of the website www.oviva.com and the associated Oviva App, we take the protection of your data very seriously. In the following, we would like to inform you about the extent to which and the purpose for which we collect and process personal data from you when using the Oviva App (hereinafter “App”).

We use the following terms, among others, in this Privacy Policy:

Personal data means any information relating to an identified or identifiable natural person (hereinafter ‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

Health data are personal data relating to the physical or mental health of a natural person, including the provision of health care services, and revealing information about that person’s state of health.

Processing is any operation or set of operations which is performed upon personal data, whether or not by automatic means, such as collection, recording, organisation, filing, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

The controller or person responsible for processing is the natural or legal person, public authority, agency or other body which alone or jointly with others determines the purposes and means of the processing of personal data.

Processor means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.

Third party means any natural or legal person, public authority, agency or body other than the data subject, the controller, the processor and the persons who, under the direct authority of the controller or the processor, are authorised to process the personal data.

Consent shall mean any freely given specific and informed indication of the wishes of the data subject, in the form of a declaration or other unambiguous affirmative act, by which the data subject signifies his agreement to the processing of personal data relating to him.

2. Responsibility and contact

The controller of the processing of personal data is the:

Oviva AG (hereinafter “Oviva”, “we”, “us”),
a company under Swiss law with its registered office at the
Zürcherstrasse 64
CH-8852 Altendorf
Handelsregisternummer CH-130.3.019.905-3
Phone: +41 41 511 52 41
kontakt@oviva.ch

If you wish to inspect and update your personal data or if you have any questions regarding data protection on our website, please contact us at any time via the email address kontakt@oviva.ch or by post at the address given above.

You can reach our data protection officer

by email: datenschutz@oviva.com or

by post: at the postal address of the data controller, with the addition of “for the attention of the data protection officer”.

3. Installation of the app

The app is available via distribution platforms operated by third parties, so-called app stores (Google Play and Apple iTunes). Your download may require prior registration with the respective app store and installation of the app store software. Oviva has no influence on the collection, processing and use of personal data in connection with your registration and the provision of downloads in the respective app store and the app store software. The responsible party in this respect is solely the operator of the respective app store. If necessary, please inform yourself directly with the respective app store provider.

4. Processing of your personal data

When you register via our website (www.oviva.com), we create a profile for you in the Oviva Coaching Suite. You can use the functionalities of the Oviva Coaching Suite via our app. We will send you the login data required to use the app by email / SMS.

The personal data that you provide to us when registering via the website will be processed by us in accordance with the website’s privacy policy.

The Oviva Coaching Suite is an electronic patient file and serves as an interface between you, your consultant and us. In the Oviva Coaching App, all (sensitive) personal data collected during registration and nutritional counselling as well as the services you have used are documented and managed. The app also offers you various functionalities for carrying out your nutritional counselling (e.g. appointment scheduling, reminders via push notification, recording of activities, booking and participation in learning programmes) and can be used by you to communicate with the nutritional counsellor (e.g. chat function for queries, exchange of current health data, etc.). Within the scope of this use, we process further personal data. Depending on the extent to which you use the app, we collect and process the following personal data:

4.1 Processing your data with your participations

4.1.1 Granting access rights

In order for the app to function properly, it is necessary for you to grant access to certain smartphone functions and personal data stored on the device. For example, you will be asked to grant the corresponding access authorization once at the beginning or only when using the respective function. Without granting the necessary access authorizations, the functions cannot be used. The processing of this data is thus based on our legitimate interest in being able to provide you with the app and its functionalities (Art. 6 (1f) GDPR or the corresponding legal basis under Swiss law).

Network access and network connections: Network access is required as the app can only be used in online mode.

You can object to this processing at any time by writing an email to the above email address. However, we would like to point out that the use of the app is no longer possible in this case.

4.1.2 Login data required to use the app

After installation, the app requires the following setup data:

E-mail address and
Password.

Or alternatively:

Mobile phone number and date of birth and
1-time code.

Your e-mail address or your mobile phone number in conjunction with your date of birth is used for unique identification when you log in to the app. The password or 1-time code is a security key that we will send to you by email or SMS after you have registered for nutritional counselling via our website or via your doctor. After the initial registration with the password sent to you, you have the option to choose your own password.

We process your registration data in order to be able to offer you our service in full and to protect your personal data from third-party access. The legal basis is Art. 6 para. 1 b) GDPR or the corresponding legal basis of Swiss law.

4.1.3 Use push notifications

The app also uses push services from the operating system manufacturers. These are short messages that are shown on the user’s display with the user’s consent and with which the user is actively informed about consultation appointments or other reminders (“Don’t forget to drink”).

You will receive regular notifications from your advisor about upcoming appointments or reminders to improve your drinking behaviour via our push notifications according to your selection.

In order to sign up for the push messages, you must confirm the query of your end device to receive the push messages. This process is documented and stored by the operating system manufacturer. For this purpose, the login time and a device token (iOS) or device ID (Android) are stored. This data is used on the one hand to be able to send you the push messages and on the other hand as proof of your registration. These are only encrypted, anonymized device IDs. A conclusion on the individual user is excluded for Oviva.

The legal basis for these processing operations is your consent and thus Art. 6 (1) a) GDPR or the corresponding legal basis under Swiss law. You can decide during the installation of the app whether you want to use this functionality. You can revoke your consent to the storage and use of your personal data to receive our push messages at any time with effect for the future. You can revoke your consent in the settings of your end device.

4.1.4 Data in “Charts”

If you make use of our nutritional advice, we collect, store and use sensitive data on your state of health and your lifestyle (e.g. height, weight, age, nutritional and eating habits, diagnoses, comorbidities), chronologically recorded measurement data on your sporting activities (number of steps, weight, energy burnt, training etc.) as well as information on the content and course of the therapy, as discussed between you and the advisor appointed by Oviva AG or exchanged electronically (in particular via the app), exclusively with your consent (Art. 9 (2a), Art. 6 (1a) GDPR or the corresponding legal basis under Swiss law).in order to be able to offer you our therapeutic nutritional advice in full in accordance with our General Terms and Conditions. For further information on how we process the health data you provide to us, please also see section 3.1 of the website privacy policy.

In the app, you have the option in particular to store personal health data in your diary under the menu item “Charts”. You can maintain the following data there:

Activities (such as walking, running, housework, cycling, steps, etc.),

Weight,

Blood glucose levels

It is your free decision whether you provide us with health data for the aforementioned purpose. You can revoke your consent for the future at any time by deleting your entries or by writing an informal message to the above-mentioned e-mail address. Data processing operations that have already taken place remain unaffected by the revocation.

4.1.5 Apple Health Kit

In addition to the manual entry of personal health data in the App (see section 4.1.4 in this regard), we also use the Health Kit framework of Apple Inc, 1 Infinite Loop, Cupertino, CA 95014, USA (hereinafter “Apple”). The Apple Health Kit provides a central location for health and fitness data on the iPhone and the Apple Watch and – with your explicit consent – allows apps to communicate with the Health Kit Store to access and share this data.

With your express consent (Art. 9(2)(a), Art. 6(1)(a) of the GDPR or the corresponding legal basis under Swiss law), we process (where applicable) your health data such as workout information (workout start and end [date], workout duration, type of workout, calories burned), distance (walking and running) and steps obtained through the Health Kit Framework to track and display your health and fitness activities.

The submission of the declaration of consent is voluntary. You can revoke this at any time with effect for the future. However, this does not affect the legality of the storage carried out on the basis of the consent up to the revocation. You can revoke your consent by changing the settings of your mobile device or by turning off the transmission of data in the app under Settings > My Information > Connect Health App.

More information about the Health Kit can be found here: https://developer.apple.com/documentation/healthkit.

4.1.6 Google Fit

If you have an Android Phone, we use Google Fit from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter “Google”), which provides a central repository for health and fitness data on your Android Phone and, with the express consent of the user, lets apps communicate with Google Fit to access and share that data.
With your express consent (Art. 9(2)(a), Art. 6(1)(a) of the GDPR or the corresponding legal basis under Swiss law), we process (where applicable) your health data such as workout information (workout start and end [date], workout duration, type of workout, calories burned), distance (walking and running) and steps obtained through Google Fit to track and display your health and fitness activities.

You can find more information about the use of Google Fit and data processing here: Terms of Use: https://policies.google.com/terms;

4.1.7 Fitbit

In addition, you have the option to link your Fitbit account from Fitbit Inc, 199 Fremont Street, 14th Floor, San Francisco, CA 94105 (hereinafter “Fitbit”) to our App.

With your express consent (Art. 9 (2) a), Art. 6 (1) a) GDPR or the corresponding legal basis under Swiss law), we process (if applicable) your health data such as heart rate, workout information (start and end of workout, duration of workout, type of workout, calories burned),distance (walking and running) and steps obtained through your Fitbit account to track and display your health and fitness activities.

The submission of the declaration of consent is voluntary. You can revoke this at any time with effect for the future. However, this does not affect the legality of the storage carried out on the basis of the consent until the revocation. You can revoke your consent by changing the settings in the app or your Fitbit account.

You can find more information about the use of Fitbit and data processing here:

4.1.8 Upload photos in the Oviva App

For the purpose of tracking your eating behaviour and sending your meals to your coach for analysis, you can add photos to the gallery in the app. This requires that you grant the app access to your camera or gallery on your device. The access to your photos on your terminal device to enable the upload as well as the subsequent processing will only take place if you have given your express consent for this (Art. 6 (1) a) GDPR or the corresponding legal basis under Swiss law).

The submission of the declaration of consent is voluntary. You can revoke this at any time with effect for the future. However, the legality of the storage carried out on the basis of the consent until the revocation is not affected by this. You can revoke your consent by changing your settings in the app under My information > Save photos in gallery.

4.1.9 Communication in the app

(1) Chat function

We offer you a chat function within the app that allows you to communicate with your coach and exchange views on the course of your consultation. If you give your explicit consent, your coach can also open a group chat with another person.

In order to offer you this function, we use the Google Workplace service of the provider Google LLC, 1600 Amphitheatre Parkway Mountain View, CA 94043, USA (hereinafter “Google”). Your data is processed on servers in the EU. An appropriate level of data protection is maintained at all times in accordance with the requirements of the European Union.

The offer of advice also via the chat function is part of our product offer. If you decide to use the chat function to communicate with your coach, the data processing is mandatory, as we cannot otherwise offer you the chat function via our app. The legal basis is our legitimate interest in providing a digital communication option with your coach with the involvement of a professional provider, Art. 6 (1) f) GDPR or the corresponding legal basis under Swiss law.

You can object to the processing of your personal data at any time by deleting individual messages in the chat history again or by sending an email with your request to kontakt@oviva.ch. Please take into account that the use of the chat function is not possible without the transmission of data to Google. If you do not wish the data processing, please use other communication channels to get in touch with your coach.

You can obtain Google Workplace’s privacy policy at:

https://gsuite.google.com/terms/mcc_terms.html as well as

https://gsuite.google.com/terms/dpa_terms.html.

(2) Coaching via video communication

You also have the option to connect with your coach online via video communication. For this purpose, we provide an online video streaming service Vonage Video API (formally Tokbox OpenTok) by Nexmo Inc. which is part of Vonage Holdings Corporation, 23 Main Street, Holmdel, NJ 07733, USA (hereinafter “Vonage”), which enables communication.

Technical information (authentication token, IP address, time of creation) is transmitted to Nexmo Inc. to establish the video communication between you and your coach.

This information is only stored to the extent necessary to establish the connection and to enforce security measures. This data is processed separately, is not assigned to any natural person and is subsequently deleted on a regular basis.

We carry out data processing with Noxmo as a processor in order to securely provide you with our nutritional advice via our app and via video communication. We thus enable you to make full use of our offers. The offer is part of our product offering. Insofar as you decide to use video communication with your coach, the data processing is mandatory, as we cannot otherwise offer you video communication via our app. The legal basis is our legitimate interest in providing a digital communication option with your coach using a professional provider, Art. 6 (1) f) GDPR or the corresponding legal basis under Swiss law.

Please take into account that the use of video communication is not possible without the transmission of data to Nexmo Inc. If you do not wish the data processing, please use other communication channels to get in touch with your coach.

You can obtain the Nexmo Inc. privacy policy at:

https://www.vonage.com/legal/privacy-policy/.

4.1.10 Return and other evaluation

We value your feedback on the functionalities of our app as well as on our service very much, which is why we give you the opportunity to do so via the app. In this way, we can constantly improve our offer and adapt it to the needs of our customers.

If you submit feedback to us directly through our app, rather than in the app or Google Play store, it will be stored by us and linked to your user profile. Optionally, you also have the option to provide your email address so that we can contact you about your feedback if this is necessary to clarify your concern. A link to your user profile is only made in order to prevent misuse of the feedback function. Your feedback is only visible to you and to us. Other app users cannot see your feedback / rating.

We process your data to improve our offer and document your feedback. The legal basis for the processing is our legitimate interest in examining your request and improving our offer (Art. 6 (1) f) GDPR) or the corresponding legal basis under Swiss law.

In order to be able to accept and manage your feedback, we use Freshdesk in our app, a helpdesk system from Freshworks Inc, 1250 Bayhill Drive, Suite 315, San Bruno, CA 94066, USA (hereinafter “Freshworks”). For this purpose, requests are stored on Freshworks’ servers in the EU or outside the EU. For this reason, to ensure a level of data protection that corresponds to the EU, we have concluded EU standard contractual clauses (Art. 46 (2) c) GDPR) with Freshworks, according to which Freshworks undertakes to comply with European data protection.

The involvement of professional providers of corresponding services is expressly provided for by law and serves our legitimate interest in being able to professionalise our offer for you and to be able to offer it in a commercially reasonable manner (legal basis: Art. 6 para. 1 f) GDPR or the corresponding legal basis under Swiss law). We remain responsible for the protection of your data even in this case.

Your feedback will be stored by us as long as your user profile exists. It will then be deleted. If you request us to delete it, we will also delete your feedback. As an alternative to deleting your feedback, we are entitled to anonymise your feedback so that it can no longer be traced back to you personally.

4.2 Data collection without your participation

4.2.1 Data processing necessary to run the app

When you install our app, information is automatically sent to the server of our app by the application (app) used on your end device. This information is temporarily stored in a so-called log file.

The following information is collected without your intervention and stored until it is deleted:

IP address of the requesting end device,
Date and time of access,
the version of the app used in each case,
Manufacturer, type and operating system of your device as well as the name of your access provider.

The aforementioned data is processed by us to ensure a smooth connection setup of the app, to ensure a comfortable use of our app, to evaluate the system security and stability as well as for other administrative purposes. The legal basis for the data processing is Art. 6 para. 1 f) GDPR.

4.2.2 Google Analytics for Firebase

The Oviva App uses Google Analytics for Firebase, an analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter “Google”).

Firebase is part of the “Google Cloud Platform” and offers numerous services for developers. You can find a list of them here: https://firebase.google.com/terms/.
Google Analytics for Firebase services use mobile device identifiers (including Android Advertising ID or Advertising Identifier for iOS) and cookie-like technologies to run. We do not use Firebase services that share personally identifiable information, such as email addresses, phone numbers, or passwords.

For most Firebase services, personal data is limited to so-called “Instance IDs”, which are provided with a timestamp. These “instance IDs” assigned by Firebase are unique and thus allow the linking of different events or processes. Google will use this information to evaluate your use of the app and compile reports on activity for us. We process reports to analyze and optimize our app functionality. For Firebase Analytics, Google also uses the advertising ID of the end device in addition to the “instance ID” described.

The information generated by Google Analytics for Firebase about your use of the app is usually transferred to and stored on a Google server in the EU. As Google is an international organization, Google relies on the standard contractual clauses approved by the European Commission as a means of ensuring adequate protection.

When starting the app for the first time, you can choose whether you consent to the described data processing by Google Analytics for Firebase (Art. 6 (1) a) GDPR or the corresponding legal basis of Swiss law). The consent to the integration of Google Firebase can be revoked at any time for the future, e.g. by restricting the use of the advertising ID in the device settings of your mobile device:

for Android: Settings – Google > Ads > Reset ad ID,
for iOS: Settings > Privacy > Advertising > No ad tracking,

or by disabling the use of Google Firebase in the app under Privacy Settings.

Further information on Google Firebase and data protection can be found at https://www.google.com/policies/privacy/ and at

at https://firebase.google.com/.

4.2.3 Mixpanel

This application uses the “Mixpanel” analytics service provided by Mixpanel Inc, San Francisco 405 Howard Street, Floor 2, San Francisco, CA 94105 (hereinafter “Mixpanel”). The Mixpanel service logs page views and page activity. To make this possible, log data is transmitted to Mixpanel. For more information about how Mixpanel uses your data, please visit the privacy page of the Mixpanel service at https://mixpanel.com/legal/privacy-policy/.

When starting the app for the first time, you can choose whether you consent to the transmission of log data of your activities to Mixpanel (Art. 6 para. 1 a) GDPR or the corresponding legal basis of Swiss law). The consent to the integration of Mixpanel can be revoked at any time for the future, e.g. by deactivating logging in the app under privacy settings.

5. Passing on the data to other third parties

5.1 Disclosure of data to external third parties

We may need to share some data with external third parties in strict compliance with applicable data protection laws in addition to the tools and features used on our website.

For the content-related technical support and design of our app, it may be necessary for external service providers to gain access to personal data (e.g. IT service providers). In this case, the handling of your personal data takes place exclusively according to our explicit instructions and on the basis of an agreement on commissioned processing pursuant to Art. 28 GDPR or the corresponding legal basis of Swiss law. With this agreement, the service provider guarantees us that the service provision is in accordance with applicable data protection law. The involvement of professional providers of corresponding services is expressly provided for by law and serves our legitimate interest in being able to professionalise our offer for you and to offer it in a commercially reasonable manner (legal basis: Art. 6 (1) f) GDPR or the corresponding legal basis under Swiss law). We remain responsible for the protection of your data even in this case.

5.1.1 For sending 1-time codes when logging in to the app

If you register with your mobile phone number and your date of birth in our app (see section 4.1.2) and therefore require a 1-time code via SMS to register, we use the Twilio service tool of Twilio Inc., 357 Beale Street, Suite 300, San Francisco, CA 94105 USA (hereinafter “Twilio”) to transmit the code.

Twilio may also process your personal data on servers in the USA. For this reason, we have concluded EU standard contractual clauses (Art. 46 para. 2 c) GDPR) with Twilio to ensure a level of data protection that corresponds to that of the EU, according to which Twilio undertakes to comply with European data protection.

For more information about Twilio’s data processing, please see Twilio’s privacy policy at https://www.twilio.com/legal/privacy.

5.1.2 Other Service providers

For more information on what data is shared with third parties when registering for nutritional counseling and during nutritional counseling, please see section 4 of the website’s privacy policy .

5.2 Disclosure due to legal obligation

We reserve the right to disclose your personal data if we are legally obliged to do so or if we are requested to do so by authorities or law enforcement agencies.

6. Analysis of anonymised data for validation purposes

In order to meet our quality standards and to improve and further develop our services, we evaluate the services we provide to you as part of the consulting relationship. For this purpose, we remove any personal reference to you and also use this anonymised data after the end of the consulting relationship for the purpose of validation and quality management (improvement and further development of our services and offers).

In addition, we analyse your anonymised data and compile statistics on various patient groups in order to better understand our patient structure and thereby also improve and further develop ourselves. Under certain circumstances, these statistics may also be used in cooperation with institutes for research purposes or may also be published.

At no time can conclusions be drawn about individual persons from the statistics used in this way.

7. Data security measures and place of data processing

We protect your personal data according to the state of the art with appropriate technical and organisational measures. All employees and contracted specialists of Oviva AG (such as your consultant) who have access to your data are bound by the GDPR, the BDSG and the corresponding Swiss law and other legal regulations for the protection of your data, as well as demonstrably obliged to process personal data exclusively on the instructions of Oviva and in a manner that ensures an appropriate level of protection for the security of the data, in particular its integrity and confidentiality, and not to disclose it to third parties without authorization. Employees involved in processing operations will be made aware of and trained in data protection requirements. Third parties will not have access to your personal data without your express consent.

Your data will be stored in a data center in Germany. In addition, we require our external service provider to use your personal data exclusively in accordance with our specifications and in compliance with this privacy policy and the legal requirements for order processing.

8. Duration of the storage of your personal data

The personal data provided by you will only be stored by us for as long as is necessary for the fulfilment of the respective purpose for which you have provided us with your data, for compliance with statutory provisions or official requirements or the assertion of or defence against claims in connection with the contractual relationship. In the latter case, your data will be pseudonymised until it is actually used for the assertion or defence of claims and blocked for any other form of data processing.

9. Data subject rights

Right to information: You can request information about the scope, origin and recipients of the stored data as well as the purpose of storage at any time and free of charge. If you wish to exercise your right to information, you can contact an employee of Oviva or the data protection officer at any time.

Right to data portability: You may obtain the personal data concerning you that you have provided to us in a structured, commonly used and machine-readable format, provided that (1) the processing is based on consent or on a contract and (2) the processing is carried out with the aid of automated procedures.

Right of rectification: Any person concerned by the processing of personal data has the right to obtain the rectification without delay of inaccurate personal data relating to him or her. The data subject also has the right to obtain the completion of incomplete personal data, having regard to the purposes of the processing.

Right to erasure (right to be forgotten): Any person affected by the processing of personal data has, in principle, the right to demand from the controller that the personal data concerning him or her be erased without undue delay, provided that the conditions pursuant to Article 17 of the GDPR (or the applicable Swiss legal bases) are met and to the extent that further processing is not necessary.

Right to object: Any person concerned by the processing of personal data has the right to object at any time to the processing of personal data relating to him or her.

We shall no longer process the personal data in the event of the objection, unless we can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or for the assertion, exercise or defence of legal claims. If we process personal data for the purpose of direct marketing, the data subject shall have the right to object at any time to processing of personal data processed for such marketing.

Right to withdraw consent under data protection law: Any person concerned by the processing of personal data has the right to withdraw consent to the processing of personal data at any time.

In the event of a claim being asserted, we will examine your claim and, insofar as no other legal regulations conflict with this, comply with it. We will inform you of the result. Compliance with a special form is not necessary for the assertion of your data protection rights. For example, write an email to kontakt@oviva.ch or use the contact options via the website or the app. If your request for information relates to specially protected data, in particular health data, a special identification of your person is required for the purpose of checking your entitlement. In this case, the request can be accompanied by, for example, a double-sided copy of the identification documents (copy of identity card, passport or certificate of registration), on which the first name and surname, the full address, the date of birth and the place of birth must be clearly legible; other information such as the photo can be blacked out.

10. Updating and changes

Parts of this Privacy Policy may be changed or updated by us without prior notice to you. Please review the Privacy Policy before using our services to be aware of any changes or updates.