Preliminary
This Privacy Policy describes how HEURAL TECH S.A. (hereinafter, “Heural” or “we”) processes the personal data of those who use its website www.heural.com and its mobile application (together, the “Heural Platform”), what data it collects, what it uses the data for, who it shares the data with and what rights the data subjects have.
This Policy forms part of the Terms and Conditions of use of the Heural Platform (the “Terms and Conditions”). Capitalized terms not defined herein —among others, “User”, “Service”, “Institution”, “Account Holder”, “Seat”, “Plan” and “Subscription”— have the meaning given to them in the Terms and Conditions.
The processing of personal data is governed by Personal Data Protection Law No. 25,326 and its Regulatory Decree 1558/2001, Law No. 26,529 on Patient Rights, Medical Records and Informed Consent, Law No. 27,553 on Electronic or Digital Prescriptions, and other applicable regulations of the Argentine Republic.
1Data controller and contact
The data controller of the databases indicated in section 2.1 is HEURAL TECH S.A., CUIT 33-71831834-9, with registered address at Jorge Newbery 1519, 4° piso, Ciudad Autónoma de Buenos Aires, Argentina.
Questions, comments and requests relating to this Policy or to your personal data may be sent by email to [email protected], stating “Privacidad” in the subject line, or by post to the address indicated.
2Scope: when Heural is the data controller and when it acts on behalf of an Institution
Two different situations coexist on the Heural Platform, as provided in Section 6 of the Terms and Conditions:
2.1Data for which Heural is the data controller
Heural is the data controller of the database with respect to: (a) Users’ registration and account data; (b) Platform usage data; (c) geolocation data; (d) the data that the patient generates or uploads in the My H-Pal mobile application for personal use, including data from wearable devices; and (e) the data related to the Subscription, invoicing and payments of the Institutions.
2.2Data for which the Institution is the data controller
The Institution is the data controller of the database with respect to the patients’ clinical information recorded by its professionals on the Platform —including the instructions, orders, prescriptions and appointments that the patient receives through the My H-Pal mobile application or the H-Chart web portal— and the studies that the patient uploads to share them with the treating professional.
With respect to that information, Heural acts as data processor (provider of data processing services, article 25 of Law No. 25,326): it processes it solely on behalf of the Institution, in accordance with its instructions and with the Terms and Conditions, and does not use it for its own purposes other than those provided for in those documents. The Institution is responsible for having the necessary legal bases and consents. Patients who wish to exercise their rights over their medical records must first contact the Institution or the professional who recorded them; if the request reaches Heural, we will forward it to the relevant Institution.
3Data we process
Depending on the type of User and the features they use, we process the following categories of data:
Registration and account data: first and last name, type and number of identity document, date of birth, sex, email address, telephone number, access credentials, role within each Institution and Seats occupied.
Professional data (healthcare professionals): profession, specialty, license number and jurisdiction, which are checked against the Argentine Integrated Health Information System (SISA) for the sole purpose of verifying the professional’s identity and the validity of their license.
Health data uploaded by the patient in My H-Pal: personal health record, studies, treatment monitoring, healthcare provider or health coverage, and data from wearable devices and device health applications that the patient chooses to link.
Clinical information recorded by the Institutions (Heural as data processor, section 2.2): electronic medical records, diagnoses, instructions, orders, prescriptions, appointments and studies shared with the professional.
Subscription and invoicing data: data of the Institution and of the Account Holder necessary to issue invoices (company name, CUIT, tax status, invoicing address and email address), Plan, number of Seats and payment history. Heural does not store card data: payments are handled within the Mercado Pago environment.
Usage and technical data: IP address, device type, operating system, browser, device identifiers, date and time of access, pages and features used, and activity records (logs) necessary for the security and auditing of the Platform.
Geolocation data: only when the User authorizes it through the permission of the device’s operating system, for the purposes indicated in section 4.
Health data are sensitive data within the meaning of article 2 of Law No. 25,326. No User is required to provide sensitive data or other personal data; however, the absence of certain data could prevent the full or partial use of the Service. The data marked as mandatory in the registration forms are necessary to create the account.
4What we use the data for
We use personal data exclusively for the following purposes:
To create and manage accounts, authenticate Users and manage their roles and Seats within the Institutions.
To provide the features of the Service described in the Terms and Conditions: personal health record, uploading and storage of studies, management of appointments and schedules, electronic medical records, treatment monitoring, issuance of electronic orders and prescriptions, interoperability and integration with wearable devices.
To verify, by consulting SISA, the identity of healthcare professionals and the validity of their license.
To manage Subscriptions, collections, the issuance of invoices and compliance with tax obligations.
To send operational communications: invitations, appointment reminders, renewal notices, notifications about the account and changes to the Terms and Conditions or to this Policy.
To safeguard the security of the Platform, prevent fraud and misuse, and verify the authenticity of the information provided, including through geolocation when the User has authorized it.
To analyze the use of the Platform in order to fix errors and improve the Service.
To generate anonymized data in accordance with section 7.
To comply with legal obligations and requests from competent authorities.
The data will not be used for purposes other than or incompatible with those for which they were obtained. Heural does not sell personal data or use them for third-party advertising.
5Consent
By registering, the User gives free, express and informed consent to the processing of their data in accordance with this Policy. For the processing of the health data that the patient uploads in My H-Pal, Heural will request a specific and separate consent, which the User may revoke at any time, without retroactive effect; revocation may prevent the use of the features that depend on those data.
By uploading a study to share it with a professional, the patient consents to that professional and the Institution to which they belong accessing it. Linking wearable devices or device health applications requires the User’s express authorization in each case and may be revoked from the settings of the device or of the application.
6Who we share the data with
Heural only discloses personal data in the following cases:
Between Users, within the Platform: clinical information is accessible to the professionals and members of the Institution that recorded it, according to the roles and permissions that the Institution configures; appointments, instructions, orders and prescriptions are made available to the patient through the My H-Pal mobile application and the H-Chart web portal.
Providers that process data on behalf of Heural, under confidentiality and security obligations, and only to provide the Service: Amazon Web Services (cloud hosting and infrastructure), Mercado Pago (payment processing) and other technology service providers necessary for the operation of the Platform.
Official health registries and systems: SISA, for the sole purpose of verifying the identity and license of professionals, and the systems necessary for the issuance and dispensing of electronic prescriptions in accordance with Law No. 27,553 and its regulations.
Authorities of an administrative or judicial nature, when there is a legal obligation or a well-founded request.
In the event of a corporate reorganization, merger, spin-off or transfer of the business, provided that the acquirer assumes the obligations of this Policy.
Outside these cases, Heural does not disclose to third parties data that allow their data subjects to be identified.
7Anonymized data, research and artificial intelligence
Heural may subject the data processed on the Platform to dissociation or anonymization processes, in accordance with Law No. 25,326, so that they do not allow the data subject to be identified, directly or indirectly. Data so anonymized cease to be personal data and may be used by Heural, in perpetuity and anywhere in the world, for statistical, research, Service improvement, and artificial intelligence model development and training purposes, in accordance with Section 6 of the Terms and Conditions. Heural will adopt reasonable technical and organizational measures to prevent their re-identification.
8Automated suggestions and decision support
Some features of the Heural Platform —such as My H-Pal’s health and wellness suggestions and H-Chart’s decision support tools— process data in an automated manner to offer guidance information. These features do not make decisions with legal effects on the User nor do they replace the judgment of the healthcare professional: their results do not constitute a diagnosis, therapeutic indication or medical advice.
9International transfer of data
The data are stored on servers or cloud services provided by Amazon Web Services located in the European Union, a jurisdiction considered to have an adequate level of personal data protection by the Argentine supervisory authority (DNPDP Provision 60-E/2016).
10Cookies and similar technologies
The Heural Platform uses only cookies and similar technologies necessary for its operation: keeping the session logged in, remembering preferences and protecting the security of the Platform. Heural does not use analytics or advertising cookies.
The User may configure their browser to block or delete cookies; blocking these cookies may prevent the Platform from working properly.
11Data retention
We retain personal data for as long as they are necessary for the purposes described or for the periods required by the regulations in force, applying the principle of data minimization. In particular:
Clinical information: it is retained for the medical record retention period required by article 18 of Law No. 26,529, even if the Institution’s account is closed or cancelled, in accordance with section 4.4 of the Terms and Conditions. During that period, the Institution may request its export.
Invoicing and payment data: for the periods required by tax regulations.
Account and usage data: while the account is active and, after its closure, for the period necessary to handle claims or comply with legal obligations.
Once those periods have expired, the data are securely deleted or irreversibly anonymized.
12Security
Heural adopts technical and organizational measures to ensure the security and confidentiality of personal data, in accordance with article 9 of Law No. 25,326 and with the security measures recommended by the Agency for Access to Public Information (AAIP), in order to prevent their alteration, loss, or unauthorized consultation or processing. Access to the information is limited to the persons who need it for the purposes described in this Policy, according to the roles and permissions defined on the Platform. The persons involved in the processing are bound by professional secrecy, even after their relationship with Heural has ended.
Access credentials are personal and non-transferable. The User must keep them confidential and notify Heural immediately of any unauthorized use of their account.
13Minors
Persons under eighteen (18) years of age may not register by themselves. The account of a minor patient must be created and managed by their father, mother or guardian, who gives consent to the processing of the minor’s data on their behalf, in accordance with Section 3 of the Terms and Conditions and without prejudice to the rights that article 26 of the Argentine Civil and Commercial Code grants to minors regarding the care of their own health.
14Rights of data subjects
The data subject may, free of charge:
Access their data. Heural will respond within ten (10) calendar days of receipt of the request (article 14 of Law No. 25,326).
Request the rectification, updating or deletion of their data, where applicable. Heural will respond within five (5) business days of receipt of the request (article 16 of Law No. 25,326). Deletion does not apply when the retention of the data is required by law, as in the case of medical records.
Revoke the consents given, without retroactive effect.
Requests must be sent to [email protected], with the subject line “Ejercicio de derechos de privacidad” (Exercise of privacy rights), together with a document evidencing the identity of the data subject or, where applicable, the representation claimed. With respect to clinical information, the provisions of section 2.2 apply.
The data subject has the right to exercise the right of access to such data free of charge at intervals of no less than six months, unless a legitimate interest to that effect is demonstrated, as established in article 14, subsection 3 of Law No. 25,326. The AGENCY FOR ACCESS TO PUBLIC INFORMATION (AAIP), in its capacity as Supervisory Body of Law No. 25,326, has the power to handle the complaints and claims filed by those whose rights are affected by non-compliance with the regulations in force on personal data protection.
15Third-party links and services
The Heural Platform may contain links to third-party sites or redirect to third-party services, such as the Mercado Pago payment environment. Those third parties have their own privacy policies, for which Heural is not responsible. We recommend reading them before providing them with personal data.
16Changes to this Policy
Heural may modify this Privacy Policy by communicating the modifications to Users no less than thirty (30) calendar days before they take effect, through: (i) the publication of the updated and current version at www.heural.net/privacidad and in the mobile application; and/or (ii) an email message addressed to the User. When a modification extends the purposes of the processing of sensitive data, Heural will request a new consent.
17Governing law and jurisdiction
This Policy is governed by the law of the Argentine Republic. For any dispute, the provisions of Section 12 of the Terms and Conditions apply.