We care about your privacy and the security of your personal data, especially health-related data, which requires a higher level of protection. Below we explain what data we process in connection with your use of the HealthKin App, for what purposes, and what rights you have.
KEY INFORMATION
1. DATA CONTROLLER:
Bambly spółka z ograniczoną odpowiedzialnością, with its registered office in Wrocław (50-266), address: ul. Wyspa Słodowa 7, entered into the Register of Entrepreneurs maintained by the District Court for Wrocław Fabryczna in Wrocław, VI Commercial Division of the National Court Register under KRS No.: 0000908263, NIP: 8652576894, REGON: 389275646, share capital: 5,000 PLN.
2. CONTACT WITH THE DATA CONTROLLER:
- correspondence address: ul. Wyspa Słodowa 7, 50-266 Wrocław, Poland
- e-mail address: adres e-mail: hello@healthkin.io
3. PURPOSES AND LEGAL BASIS FOR PROCESSING PERSONAL DATA:
If you visit our website – Article 6(1)(f) GDPR – legitimate interest of the controller: ensuring the website's operation and analyzing traffic.
If you install the HealthKin App:
- Article 6(1)(b) GDPR – to provide services,
- Article 6(1)(c) GDPR – to comply with tax and accounting obligations,
- Article 6(1)(f) GDPR – our legitimate interest: defense against claims and pursuing claims,
- Article 9(2)(a) GDPR – based on your explicit consent, we process special category personal data, i.e., health-related data that you enter into the App,
- Article 9(2)(a) GDPR – based on your explicit consent, we process special category personal data, i.e., health-related data that you enter into the App for analysis using artificial intelligence (AI) solutions.
If you contact us for other purposes – Article 6(1)(f) GDPR – our legitimate interest: communication and providing responses, as well as pursuing and defending claims.
If you visit our social media – Article 6(1)(f) GDPR – our legitimate interest: marketing activities.
If you have consented to the processing of your personal data for marketing purposes:
- Article 6(1)(f) GDPR – our legitimate interest: conducting marketing and promotional activities,
- Article 6(1)(a) GDPR – when you consent to receiving specific marketing communications.
4. YOUR RIGHTS
Right to access, rectify, erase data, request restriction of processing, request data portability, file a complaint with the President of the Personal Data Protection Office, object to processing, and withdraw consent.
DETAILED INFORMATION:
We process your personal data in accordance with the provisions of the GDPR [Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).
1. WHO IS THE CONTROLLER OF YOUR PERSONAL DATA?
The controller of your personal data is Bambly spółka z ograniczoną odpowiedzialnością, with its registered office in Wrocław (50-266), address: ul. Wyspa Słodowa 7, entered into the Register of Entrepreneurs maintained by the District Court for Wrocław Fabryczna in Wrocław, VI Commercial Division of the National Court Register under KRS No.: 0000908263, NIP: 8652576894, REGON: 389275646, share capital: 5,000 PLN.
2. HOW CAN YOU CONTACT THE CONTROLLER?
You can contact the controller via the following means:
- by mail to correspondence address: ul. Wyspa Słodowa 7, 50-266 Wrocław, Poland
- by e-mail to: hello@healthkin.io
3. ON WHAT BASIS DO WE PROCESS PERSONAL DATA?
The legal basis for processing personal data varies depending on the situations described below and depends on your interaction with us:
If you visit our website www.healthkin.io
We process your personal data to:
- ensure the proper functioning of the website,
- monitor traffic,
- display advertisements and conduct marketing activities,
- potentially counteract activities inconsistent with generally applicable laws.
We store data in particular in cookies and website visit logs. This data may include your IP address.
The legal basis for data processing in this regard is Article 6(1)(f) of the GDPR, which allows data processing when necessary to achieve the purposes arising from the legitimate interests pursued by the controller or a third party.
The controller's legitimate interest in this case is to ensure the proper functioning of the website, maintain statistics on website performance, display advertisements, and prevent fraud and violations of law.
If you install the HealthKin App and create an Account
If you install the App to use our services, we process your personal data to take action at your request prior to entering into a contract.
If you create an account in the App, i.e., enter into a contract with us, we process your personal data to provide our services in accordance with the contract.
In such cases, the legal basis for personal data processing is Article 6(1)(b) of the GDPR, which allows for data processing where necessary to conclude and perform a contract to which the data subject is a party, or to take action at the request of the data subject prior to entering into a contract.
Furthermore, we process your data to comply with our legal obligations related to entering into contracts, in particular accounting and tax obligations – pursuant to Article 6(1)(c) of the GDPR, which allows for data processing where necessary to comply with a legal obligation to which the controller is subject.
We also process your data for the purpose of defending against and pursuing claims, which constitutes our legitimate interest – in such a case, the processing of personal data takes place on the basis of Article 6(1)(f) of the GDPR, which states that data processing is permissible when it is necessary to pursue the legitimate interests of the controller.
We do not use your data to train our AI models or develop our services.
If you enter data concerning your health into the App and analyze it using AI
As part of using HealthKin, you can:
- enter health-related data, including, in particular, medical records, test results, prescriptions, vaccination records, and other medical information;
- analyze this data using solutions based on artificial intelligence (AI).
This data constitutes special category personal data within the meaning of Article 9(1) of the GDPR. The legal basis for the data processing referred to in point 1 and point 2 is based on two separate, express consents, granted independently of each other, in accordance with Article 9(2)(a) of the GDPR.
Consents are given voluntarily by checking separate checkboxes in the App and may be withdrawn at any time. Withdrawal of consent does not affect the lawfulness of processing carried out prior to its withdrawal, but does result in the inability to use the App's functionalities.
We do not use your health data to train our AI models or develop our services.
If you contact us by email, letter, telephone, or contact form – for purposes other than those indicated above
We process your personal data, such as your name, email address, mailing address, telephone number, and the content of correspondence or conversations, for the purpose of contacting you and exchanging messages.
The legal basis for data processing in this regard is Article 6(1)(f) of the GDPR, which allows data processing where necessary to achieve the purposes of the legitimate interests pursued by the controller or a third party.
The controller's legitimate interest in this case is the need to process data to contact individuals and respond to their submitted content.
If you visit our social media profiles
We maintain profiles on Facebook, Instagram, and YouTube. If you visit our social media profiles, follow them, and interact with posts or videos, we process your personal data to monitor traffic and conduct marketing activities related to our goods and services. We may send you marketing content on social media platforms in accordance with the terms and conditions of these platforms.
The legal basis for data processing in this regard is Article 6(1)(f) of the GDPR, which allows data processing where necessary to achieve the purposes arising from the legitimate interests pursued by the controller or a third party.
The legitimate interest in this case is the controller's marketing and promotional activities.
If you have consented to our processing of your personal data for marketing purposes, including receiving emails or text messages with marketing communications
We process your personal data for marketing and promotional purposes, which constitutes our legitimate interest. Data processing in this regard is based on Article 6(1)(f) of the GDPR, which states that data processing is permissible when it is necessary to pursue the legitimate interests of the controller.
At the same time, we reserve that in a situation where separate regulations require us to obtain consent to send you specific marketing communications, such as text messages, e-mails or telephone calls, we will collect separate consent from you in this respect.
4. WHO MAY PERSONAL DATA BE SHARED WITH?
Your data may be transferred to the following categories of recipients:
- Cloud service providers – Amazon Web Services EMEA SARL, based in Luxembourg, and Amazon Web Services, Inc., based in Seattle, Washington, USA;
- Marketing service and analytical tool providers who support us in conducting marketing activities, organizing advertising campaigns, and performing analytics within our application – Google Ireland Limited and Google LLC, based in Mountain View, California, USA;
- Email service providers – Plus Five Five, Inc. (Resend), based in San Francisco, California, USA;
- Bug monitoring service providers – Functional Software Inc. (Sentry), based in San Francisco, California, USA;
- Push notification service providers – 650 Industries, Inc. (Expo), based in Palo Alto, California, USA.
The legal basis for the transfer of personal data to these entities in the USA is their participation in the Data Privacy Framework program, which has been recognized by a decision of the European Commission as providing an adequate level of protection.
Additionally, we may also transfer your data to:
- Entities providing hosting services, server maintenance, electronic mail, and providers of project management and communication tools.
- External law firms, accounting offices, bookkeeping firms, and tax advisors.
To promote our business, we use social media platforms and marketing tools. This involves transferring data to the following entities:
- Meta Platforms (Facebook, Instagram, Meta Pixel) – the legal basis for such data transfer is Meta's participation in the Data Privacy Framework program, recognized by the European Commission as providing an adequate level of protection;
- LinkedIn (LinkedIn Ireland/Corp.) – the legal basis for such data transfer is LinkedIn's participation in the Data Privacy Framework program, recognized by the European Commission as providing an adequate level of protection;
- X (formerly Twitter) – the legal basis for such data transfer is X's participation in the Data Privacy Framework program, recognized by the European Commission as providing an adequate level of protection;
- TikTok (TikTok Technology Ltd) – the legal basis for such data transfer is the Standard Contractual Clauses (SCC).
In order to improve our services, automate processes, and analyze content, we may use the services of artificial intelligence providers.
Your data may be processed by these entities to the extent necessary to generate a response or perform an analysis.
In cases where these providers are based outside the EEA (e.g., in the USA), the transfer takes place based on the European Commission's adequacy decision (Data Privacy Framework) or Standard Contractual Clauses.
5. HOW LONG DO WE STORE PERSONAL DATA?
We strive to store personal data only for as long as it is truly necessary, and then delete it:
- If you have visited our website, we process your personal data for as long as you use the website and for up to 14 months after you leave.
- If you are a registered HealthKin user, your personal data will be processed for the duration of the contract and for the limitation period for claims. Data processed on the basis of consent (e.g. medical data) will be processed no longer than until you withdraw your consent.
- If you contact us by email, letter, telephone, or contact form for a purpose other than the concluded contract, we process your personal data for as long as the relationship between us continues and for the following 12 months.
- Data processed to fulfill accounting and tax obligations will be processed for a period of 5 years from the end of the tax year in which the tax payment deadline expired.
- If you follow us on a social media platform or interact with our posts or videos on YouTube, Facebook, or Instagram, we process your personal data for the duration of the interaction between you and our fan page.
- If you receive marketing communications from us, we process your personal data until you withdraw your consent to marketing contact or until the marketing campaign ends, whichever comes first.:
6. WHAT RIGHTS DO YOU HAVE IN CONNECTION WITH DATA PROCESSING??
In connection with the processing of your personal data, you have the following rights:
Right of access
You may request confirmation from us that your personal data is being processed and to obtain relevant information about it, including information on what data is being processed and for what purpose.
Right to rectification
You have the right to request the immediate rectification of inaccurate personal data and the completion of incomplete personal data.
Right to erasure
You have the right to request the immediate erasure of personal data if one of the following circumstances applies:
- the personal data are no longer necessary for the purposes for which they were collected or otherwise processed;
- you have withdrawn your consent to data processing and there is no other legal basis for the processing;
- you have objected to the processing and there are no overriding legitimate grounds for the processing;
- the personal data were processed unlawfully; Personal data must be erased to comply with a legal obligation.
This does not apply to the extent that the processing of personal data is necessary:
- to exercise the right to freedom of expression and information;
- to comply with a legal obligation imposed on the controller requiring data processing;
- to establish, pursue, or defend legal claims.
Right to request restriction of processing
You have the right to request restriction of processing of personal data if:
- you contest the accuracy of the personal data – for a period enabling us to verify the accuracy of the data;
- the processing is unlawful, but you object to the erasure of the personal data and instead request the restriction of their use;
- we no longer need the personal data for processing purposes, but you require them to establish, pursue, or defend legal claims;
- you have objected to the processing of the data – until we determine whether our legitimate grounds override the grounds for your objection.
Right to request data portability
You have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit this personal data to another controller if the processing is based on consent or on a contract and is automated.
Right to file a complaint
You have the right to file a complaint about unlawful processing of your personal data with the supervisory authority – the President of the Personal Data Protection Office.
Right to object
You have the right to object to processing based on our legitimate interest.
Right to withdraw consent
If your personal data is processed based on consent, you have the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.
7. WHAT ELSE YOU SHOULD KNOW?
Your personal data will not be used for automated decision-making, including profiling, as referred to in Article 22(1) and (4) of the GDPR.
Providing your personal data is voluntary, but if your data is processed for the purpose of entering into or performing a contract with us, failure to provide your data may result in our inability to provide our services.
COOKIE FILES
Cookies are small files that enable or facilitate the use of certain website features. They may be stored on your device directly by us or by third parties with whom we cooperate. When using cookies, we may process personal data, in particular your IP address, website usage history, and information about the device or software you are using. The cookies we use are related to the operation of our website, and are used to monitor website traffic, compile statistics on user use, conduct marketing activities, prevent errors and technical faults, ensure website security, and prevent abuse and violations of law.
The following cookies are distinguished:
- Session cookies: these are stored on your device while you are using our website (they are deleted when you close your browser). Session cookies enable the proper use of our website. Blocking them may result in errors or prevent you from using the website.
- Persistent cookies: these are stored on your device until they are deleted or until they expire.
Additionally, cookies are divided into the following categories:
- Technical cookies – these cookies are necessary for the proper display and operation of the website. These cookies may also detect irregularities in the website's operation and help in fixing errors, as well as enable verification of the user's consent to other cookies. Blocking them may result in the website not functioning properly.
- Analytical and statistical cookies – cookies that enable the creation of statistics on user use of the website. They enable, among other things, the analysis of the website's functionality. We use cookies to monitor website traffic, count visits, measure website usage, and analyze the devices and browsers used by users. We use tools such as Google Analytics to conduct analytical activities. These tools may require the use of cookies.
- Marketing cookies – cookies responsible for advertising and marketing activities, particularly those related to the use of Google Ads services. They also include remarketing activities, i.e., encouraging users to return to the website. Consent to the use of these cookies will allow us to target you with advertisements based on your previous activities on our website.
- Social media cookies – cookies associated with social media platforms we use, such as Facebook, Instagram, and YouTube. Accepting them will allow us to associate your visit to the website with our social media profiles.
Detailed information about which cookies may be stored on your device can be found in the cookie information banner displayed on the website. It contains information about specific cookies, their purpose, and the duration of their storage on your device.
The use of cookies is based on your consent, expressed in accordance with Article 398 of the Electronic Communications Act. Failure to do so or subsequent deletion of cookies may result in the inability to use the website's functionalities.
You can restrict or disable cookies on your device using your web browser settings. Web browsers allow you to disable all or some cookies (e.g., third-party cookies). If you partially disable cookies, cookies generated by our website may be saved on your device, enabling the website to function properly. However, if you restrict the use of cookies, your use of certain services may be limited, and in some cases, it may not be possible to do so.