Aria Privacy Policy

1. Data Controller

1. DCENTRIC HEALTH LTD a company formed under the laws of Cyprus with registration Number (ΗΕ 391425) and registered office at 7 Agiou Mina Str. PANORAMA RESIDENCE BLOCK B, Flat 101 Limassol P.C 4104 (henceforth for the purposes of brevity shall be called “Provider”).
2. Contact email for exercising rights arising from this policy:
‍1. aria@myaria.health
3. This data protection policy is limited to personal data processed by ARIA.
4. Definitions used here are referring also to the Terms and Conditions dated ‘February 6th 2020’ which are applicable to ARIA.

2. Important Announcement Regarding the Right to Be Forgotten

1. ARIA uses a blockchain implementation to process (store) health data. The Provider facilitates the exercise of the Right to be Forgotten (mentioned in point 3.3) by delinking and destroying the recovery phrase (private key) which connects the encrypted health data stored on the blockchain with a natural person (user).
2. What remains after the delinking and destruction of the phrase (key) is medical data which cannot be connected to a natural person (non-identifiable personal data).
3. If you do not agree to the implementation of the Right to be Forgotten do not use ARIA.
4. For more information regarding this implementation please contact us the email address mentioned in point 1.2.1.

3. Rights of the data subject

1. Right of access to the personal data that concern you provided that they are processed by the Provider.
2. Right to rectification of inaccurate data as well as to have incomplete personal data to be completed in full.
3. Right to erasure of your personal data without prejudice to the Provider’s obligations and legal rights.
4. Right to restriction of processing your personal data.
5. Right to withdraw your consent.

4. How to exercise rights

1. Any request regarding your personal data and the exercise of your rights shall be addressed by email to the Provider.

5. Complaint

1. You have the right to appeal to the Cyprus Commissioner for Personal Data Protection.
2. Contact Information:
‍1. http://www.dataprotection.gov.cy

6. Personal Data Processed

1. Full Name(First Name, Last Name)
2. Phone Number
3. Email (in case this is identifiable personal data)
4. Aria ID (in case this is identifiable personal data)
5. Public Key
6. Gender
7. Date of Birth
8. Special Categories of Data (sensitive data):
    1. Health Data (indicative and not exhaustive list): height, weight, heart rate,      blood analysis, and metabolic rates and levels.
9. Identification Documents (in cases where needed to recover account)
10. For Doctors
     1. Medical License Information
     2. Specialization
     3. Specialization

7. Non-identifiable Data Collected

1. Usage Information such as the time spent to create an account, number of records received and shared, what screens or features you access, and other similar types of usage information.
2. Device Information: We collect information about the mobile device you use to access our Services, including the hardware model, operating system and version, device identifiers set by your device operating system, and mobile network information (like your connection type, carrier and region).

8. Purpose of the processing

1. To provide access and the ability to use the mobile application ARIA.
2. Conducting interviews with users to provide feedback on ARIA.

9. Lawfulness for the processing of personal data

1. For purpose on point 8.1
   1. Consent for all personal data-including special categories.
2. For purpose on point 8.2
   1. Consent for the use of phone number.
   2. Legitimate interests regarding the enhancement of performance on ARIA for    the use of email.

10. Data storage period

1. As long as the user is using the service.

11. Recipients

1. Personal data that are not considered special categories:
   1. Indicatively: Legal Advisor, Application Developers, Technical Support Staff of    the Provider.
2. Health Data:
   1. Persons that the User has authorized via ARIA.
3. No data is transferred to third parties for any commercial purpose.
4. For Doctor-category users:
   1. Patient-category users may see personal data such as:
      1. Name, Surname, Specialization, License Number, Institution (by default).
      2. Contact Details may be shared by the Doctor from within the app.

12. Data transfer outside the European Union

1. Data transfer outside the European Union

13. Automated Decisions

1. No automated decisions are made based on personal data processed by the Provider.

14. Data Portability

1. Users may extract their personal data to facilitate their portability. The Provider does not provide an implementation to facilitate data portability to third parties directly.

15. Extraction of Personal Data

1. Users may extract their personal data (including health data).
2. Users are strongly advised to use security measures when extracting their data.

16. Cookies

1. We use automated data collection tools such as Cookies to automatically collect the non-identifiable data outlined in point 7.

Request a demo