Data Processing Policy

PIVOT MOBILE APP DATA PROCESSING POLICY

1. INTRODUCTION AND SCOPE

1.1. This Data Processing Policy (“Policy”) describes how Pivot (“we,” “us,” or “our”) processes Personal Data in connection with our health management platform and services.

1.2. This Policy applies to all Personal Data processing activities carried out by Pivot, including data collected through our mobile application, website, and related services.

1.3. We are committed to processing Personal Data in accordance with applicable data protection laws, including the EU General Data Protection Regulation (EU) 2016/679 (“GDPR”) and the Danish Data Protection Act.

2. DATA CONTROLLER AND PROCESSOR

2.1. Pivot acts as both a data controller and a data processor in relation to the Personal Data we process.

2.2. As a data controller, we determine the purposes and means of processing Personal Data for our own business operations, including service provision, customer support, and business development.

2.3. As a data processor, we process Personal Data on behalf of our users when they provide health information and preferences for our health management services.

3. CATEGORIES OF PERSONAL DATA

3.1. Identity Data: Name, email address, phone number, date of birth, and other identifying information provided during account registration and profile creation.

3.2. Health Data: Blood glucose levels, medication information, dietary preferences, exercise data, weight, and other health-related information you choose to share with us.

3.3. Technical Data: IP address, device information, browser type, operating system, and usage analytics collected automatically when you use our services.

3.4. Communication Data: Information contained in or relating to any communication you send to us, including support requests and feedback.

4. LEGAL BASIS FOR PROCESSING

4.1. Consent: We process your Personal Data based on your explicit consent, which you provide when creating an account and using our services.

4.2. Contract Performance: We process Personal Data necessary for the performance of our contract with you, including providing health management services and support.

4.3. Legitimate Interests: We may process Personal Data for our legitimate interests, such as improving our services, preventing fraud, and ensuring security.

4.4. Legal Obligations: We may process Personal Data to comply with applicable Danish and EU laws and regulations, including health data protection requirements.

5. PURPOSES OF PROCESSING

5.1. Service Provision: To provide personalised health management services, including meal planning, health tracking, and educational content.

5.2. Account Management: To create and manage your account, process payments, and provide customer support.

5.3. Communication: To send you important updates about our services, respond to your inquiries, and provide technical support.

5.4. Research and Development: To improve our services and develop new features through analysis of anonymised data, and to invite you to take part in voluntary user research, including interviews, usability testing and surveys. Participation is optional, you may decline or withdraw at any time, and any research that involves your health information is carried out only with your explicit consent.

6. DATA RETENTION

6.1. Account Data: We retain your account information for as long as your account is active and for a reasonable period thereafter to comply with legal obligations.

6.2. Health Data: We retain your health information only for as long as necessary for the purposes for which it was collected and in accordance with applicable Danish and EU laws.

6.3. Technical Data: We retain technical and usage data for up to 2 years for analytics and service improvement purposes.

7. DATA SECURITY MEASURES

7.1. Encryption: All Personal Data is encrypted in transit using TLS/SSL protocols and at rest using industry-standard encryption algorithms.

7.2. Access Controls: We implement strict access controls and authentication mechanisms to ensure only authorised personnel can access Personal Data.

7.3. Regular Audits: We conduct regular security audits and assessments to identify and address potential vulnerabilities in our data processing systems.

8. DATA SUBJECT RIGHTS

8.1. Right of Access: You have the right to request access to your Personal Data and receive information about how we process it.

8.2. Right of Rectification: You have the right to request correction of inaccurate or incomplete Personal Data.

8.3. Right of Erasure: You have the right to request deletion of your Personal Data, subject to legal and contractual obligations.

8.4. Right to Data Portability: You have the right to receive your Personal Data in a structured, machine-readable format.

8.5. Right to Complain: You have the right to lodge a complaint with the Danish Data Protection Agency (Datatilsynet) if you believe your rights under the GDPR have been infringed.

9. INTERNATIONAL DATA TRANSFERS

9.1. Data Storage: Your Personal Data is primarily stored and processed within the European Economic Area (EEA), where our main operations are located.

9.2. Third-Party Services: We may use third-party service providers located outside the EEA. In such cases, we ensure appropriate safeguards are in place in accordance with the GDPR (for example, Standard Contractual Clauses or an adequacy decision).

10. CONTACT INFORMATION

If you have any questions about this Data Processing Policy or wish to exercise your data subject rights, please contact us at hello@pivot.dk.