Privacy Notice Form – Data Subjects
Requirement Details
Title of Privacy Notice: Privacy Notice to Data Subjects Using ALLYcgm and/or ALLYpro Services
Brief description of requirement: Privacy Notice for users of ALLYcgm and/or ALLYpro Services
Information to be Provided
1. Identity and contact details of the controller and, where applicable, of the controller’s representative
2. Contact details of the data protection officer, where applicable
If you have any questions regarding this notice or if you would like to speak to us about the manner in which we process your personal data, please send an email to privacy@agamatrix.co.uk. You may write also to us at: The Data Controller, AgaMatrix Europe Limited, Harwell Innovation Centre, Curie Avenue, Harwell Oxford, Didcot, Oxfordshire, OX11 0QG.
3.1. The purposes and legal basis of the processing
The Company may process personal data relating to you in connection with your use of ALLYpro and ALLYcgm as is set out below.
Categories of Personal Data processed
The Categories of Personal Data that the Company may process about you are as follows:
Identity Data may include your name, date of birth, and gender.
Contact data may include your address, email address, telephone number and marketing preferences.
Services data may include your payment details (including card details) and log-in details, information in respect of the products you have purchased, sensor information (unique sensor identifier information, PIN code, hardware version, software version, model number, lot information, etc.), mobile device information (device model, OS information, unique device identifier, ring tone mode, notification activation status, Bluetooth activation status), app settings information (app name, version, package name, installation time and date, permissions, database version, local settings information, etc.), log data, cookies and usage time.
The ALLYcgm app may access and collect location information even when the app is closed or not in active use, for the purpose of scanning for Bluetooth devices to ensure that such devices can connect to our product and services. The collected location data is neither stored nor transmitted by the Company.
Customer interaction data may include details of customer service calls automatically collected (including talk time, location, agent who answered the call, recordings of calls), any information about queries and complaints you provide us and customer support query records from our customer service platforms.
Health data may include blood glucose levels (measured by sensor and blood glucose meter for calibration), alert information, event log information, event information (blood glucose, ketone, insulin, oral medications) and diabetes type.
Purposes of processing
The Company processes the above Personal Data for, and in connection with, the following purposes:
Lawful bases of processing
We will only use your personal data where we have a lawful basis to do so. Most commonly, we will use your personal data pursuant to one of the following lawful bases:
We have set out below a table showing the ways we plan to use your personal data, and which of the legal bases we rely on to do so. We have also identified our legitimate interests where appropriate.
Please note that we may process your personal data for more than one lawful ground depending on the specific purpose for which we are using your data. Please contact us if you need details about the specific legal ground we are relying on to process your personal data where more than one ground has been set out in the table below.
Purpose/Activity | Lawful basis for processing (including details of the relevant legitimate interest) | Categories of personal data |
providing ALLYcgm and ALLYpro services, including by displaying and analysing your blood glucose level records on the ALLYcgm app | (a) performance of a contract with you, or in order to take steps at your request prior to entering into such a contract (b) in respect of Health data, your consent (c) necessary for our legitimate interests of developing our business by providing you with a service | Identity data Contact data Services data Health data |
to open and manage users’ accounts and access to the services | (a) performance of a contract with you, or in order to take steps at your request prior to entering into such a contract (b) necessary for our legitimate interests of developing our business by providing you with a service | Identity data Contact data Services data Customer interaction data |
providing ALLYpro services, including by sharing data with healthcare providers and enabling them to monitor a user’s health data | (a) performance of a contract with you, or in order to take steps at your request prior to entering into such a contract (b) in respect of Health data, your consent (c) necessary for our legitimate interests of developing our business by providing you with a service | Identity data Contact data Services data Health data |
responding to any queries or complaints you may have in respect of the services provided | (a) necessary for our legitimate interests of providing you with a high standard of service so as to develop our business and addressing any issues in connection with your use of the services | Identity data Contact data Services data Customer interaction data |
to gain a better understanding of diabetes and related matters, including in order to develop and improve your experience and our services | (a) in respect of health data, your consent (b) necessary for our legitimate interests of developing our business by providing you with a service | Identity data Contact data Services data Customer interaction data Health data |
to engage in marketing and business development activity (including sending you emails, news and offers and inviting you to events) | (a) your consent (b) our legitimate interests (where you have purchased services from us and have not opted-out of receiving such communications) of developing our business | Identity data Contact data |
to comply with our legal and regulatory obligations | (a) necessary to comply with a legal obligation (b) our legitimate interests of ensuring compliance with laws and regulations in respect of our business | Identity data Contact data Services data Customer interaction data |
to scan and monitor emails sent to us (including attachments) for viruses or malicious software, to process and encrypt personal data to protect and manage email traffic, and to store personal data on our systems | (a) necessary to comply with a legal obligation (e.g. data protection laws) (b) our legitimate interests of ensuring compliance with laws and regulations, and for the administration of our business and management of our systems | Identity data Contact data Services data Customer interaction data |
generally to manage the business activities of the Company, including providing services ancillary to the services, managing and safeguarding our systems, executing our document storage and retention policies and procedures, and other ordinary course business activities. We may also share your personal data with third parties in certain circumstances including our third party service providers and in the context of a business re- organisation, sale or acquisition (see section 5 of this Policy for further details). | (a) performance of a contract with you, or in order to take steps at your request prior to entering into such a contract (b) necessary for our legitimate interests of developing our business by providing you with a service | Identity data Contact data Services data Customer interaction data |
3.2. Collection and Use of Personal Information in Relation to i-SENS Integrated Membership Services
The Categories of Personal Data that the Company processes about you, for this purpose, are the following:
The Company processes the above Personal Data to manage signups, user identification, and answer questions and handle complaints. This, among other purposes, serves to identify whether the user is a minor (under the age of 18).
The Company uses different legal grounds as a basis for the data processing; namely,
4. Special categories of Personal Data (if applicable)
We will only process your health data (which is special category data for the purposes of, and is afforded additional protection under, the UK GDPR) if we have your consent to that processing and, if we have such consent, we will only use it for the purposes you have consented to.
Other than as is set out above, we do not knowingly or intentionally collect special category data from individuals, and you must not submit special category data to us (other than for the purposes set out above). If, however, you otherwise inadvertently or intentionally transmit special category data to us, you will be considered to have explicitly consented to us processing that special category data under Article 9(2)(a) of the UK GDPR. We will use and process that special category data for the purposes of deleting it.
5.1. The recipients, or categories of recipients, of the data, if any
We may share your personal data with our affiliates or third parties, such as advisors (including lawyers and accountants), service providers, providers of third party software (including that which is used in the provision of the services), your care providers, providers of document storage services, IT service providers, regulatory bodies (such as HMRC) and other parties involved in your matters, in each case for the purposes set out in the table above. Where such data is provided to third parties, except if the third party acts as “controller” and is therefore bound to comply with data protection laws anyway, we will enter into agreements with such third parties to ensure that they process that data in accordance with the requirements of the data protection laws.
Please note that we may also share your personal data with third parties in the context of a business re-organisation, sale or acquisition.
5.2. Give details of any planned transfers of Personal Data to a third country or international organisation
Certain of our service providers are based outside the UK so their processing of your personal data will involve a transfer of data outside the UK.
Whenever we transfer your personal data out of the UK, we ensure a similar degree of protection is afforded to it by ensuring at least one of the following circumstances applies:
Please contact us for further information on the specific mechanism we use when transferring your personal data out of the UK.
Personal Data may be shared with other i-SENS branches and subsidiaries (i.e., intra-group entities, including AgaMatrix Europe Ltd.) or with third parties.
The Company will need to share Personal Data about you with i-SENS GmbH i.G., a subsidiary in Germany who will process your Personal Data for providing [customer services].
All [employees, office managers] of [i-SENS GmbH i.G.] have limited access to information about you contained in the [CS Log Web].
The Company may also share Personal Data with Amazon Web Services Korea, LLC / The Constant Company, LLC, which are engaged to [operate and manage infrastructure], for example, to [store and back up data]. In all such cases, the Company will enter appropriate contracts with these parties to ensure that they process Personal Data only in accordance with our instructions, provide these services, and protect the integrity and confidentiality of the Personal Data.
Among other purposes, this Personal Data is shared with distributors in the EU Region to process customer data on behalf of i-SENS to provide services to users.
Recipient | Details of Processing |
Glooko | If you choose to connect your device with Glooko’s diabetes management platform, we will share your Personal Data with Glooko. We share this to enable you to view and manage your glucose data within the Glooko app, access their analytics tools, and share data with your healthcare providers through their platform. This Personal Data would only be shared based on your explicit consent, which you can withdraw at any time. Glooko processes your data as a separate data controller under their own privacy policy, available at https://glooko.com/en_UK/privacy/ |
For the purposes set out in Article 3 of this Notice, the Company may also disclose a data subject’s Personal Data to its auditors, lawyers, consultants, law enforcement, and other public authorities (such as tax and social security bodies), the police, prosecutors, courts, and tribunals. All these recipients are responsible for determining the purposes and means of processing and for its lawfulness.
6. How long will the personal data be stored for (or the criteria used to determine that period)?
We will only retain your Personal Data for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. We may retain your Personal Data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect of our relationship with you.
To determine the appropriate retention period for Personal Data, we consider the amount, nature and sensitivity of the Personal Data, the potential risk of harm from unauthorised use or disclosure of your Personal Data, the purposes for which we process your Personal Data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.
7. Data subject’s rights
7.1 Access
You have the right to obtain from us confirmation if Personal Data is being processed about you, the purposes of processing, the categories of data being processed, the legal basis of the processing, information on the parties we transfer the data to and (if applicable) the countries outside the UK in which they are located, the safeguards put in place for the transfer of data to countries outside the UK, storage period of data or criteria to determine it, further information on your rights, our processing activities and sources of the Personal Data.
7.2 Rectification
You have the right the request the rectification of inaccurate Personal Data and to have incomplete data completed.
7.3 Erasure
You may request to erase your Personal Data if (i) it is no longer necessary for the purposes for which we have collected it, (ii) you have withdrawn your consent and no other legal ground for the processing exists, (iii) you objected and no overriding legitimate grounds for the processing exist, (iv) processing is unlawful, or (v) erasure is required to comply with a legal obligation.
7.4 Portability
You may receive your Personal Data that you have provided to us, in a structured, commonly used, and machine-readable format and have the right to transfer it to other data controllers without hindrance. This right only exists if the processing is based on your consent or a contract.
7.5 Restriction You may request to restrict processing of your Personal Data if (i) you contest the accuracy of it – for a period we need to verify your request; (ii) the processing is unlawful and you oppose the erasure of it and request restriction instead; (iii) we no longer need it, but you tell us you need it to establish, exercise, or defend a legal claim; or (iv) you object to processing based on public or legitimate interest.
7.6 Objection
You have the right to object to the processing of your Personal Data in certain circumstances and we shall cease to process that Personal Data unless we have compelling and legitimate reasons which override your interests, rights and freedoms or we require it for the establishment, exercise or defence of legal claims.
8. Describe the data subject’s rights to withdraw consent at any time (if applicable)
Please note that in the event we ask for your consent to processing, you are free to refuse to give consent and you can withdraw your consent at any time. If you do not provide or withdraw your consent, we may be unable to provide you with certain services. The lawfulness of any processing of your Personal Data that occurred based on our legitimate interest and prior to the withdrawal of your consent will not be affected.
You can require us to stop sending you marketing messages at any time by following the opt-out/unsubscribe links on any marketing message sent to you or by contacting us by email at privacy@agamatrix.co.uk or write to the Company at [Harwell Innovation Centre 173 Curie Avenue, Harwell Science And Innovation Campus, Didcot, United Kingdom OX11 0QG]
9. Detail the data subject’s right to lodge a complaint with a supervisory authority
You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the supervisory authority in the UK for data protection issues (www.ico.org.uk). We would, however, appreciate the chance to deal with your concerns before you approach the ICO so please contact us in the first instance.
10. Is the Personal Data a statutory or contractual requirement and are they obliged to provide it?
Where we need to collect personal data by law, or under the terms of a contract we have with you, and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you (for example, to provide you with our services). In such circumstances, we may have to decline or cease to provide you with the relevant service, but we will notify you if this is the case at the time.
11. Will the personal data be subject to automated processing, including profiling? If so, describe the logic and potential consequences involved
The Company does not process your Personal Data using solely automated decision-making, including profiling.
