Shareguard Health Privacy Policy

1. General

Hygiaso AG ("Hygiaso", "We", "Us", "Our") operate the shareguard web site (shareguard.cloud) and any associated linked sites and services which link to the Shareguard Health Terms & Conditions ("Terms"), individually or collectively the "Application".

We own, develop, and operate the Application, to provide Our services to its Users ("You", "Yours").

This Privacy Policy describes how the Application collects, manages, uses and shares Personal Data (PD). Personal Data is defined in the Swiss Federal Data Protection Act (FDAP) and the General Data Protection Regulation (GDPR) as "any information relating to an identified or identifiable person.

The Application is a web-based application with which you as a private individual (Private User) or as a professional on behalf of your entity (Professional Users), either is a User, are or will be able to transfer or receive data, hold a copy of such data, evaluate your data and determine what you share with other Users. We provide a mere data transfer and evaluation service to you. To perform these transfers or evaluations, we let you upload the data to a dedicated cloud space. We process that data to make it searchable and queryable for you and provide you with a tool to query your data in natural language text.

Hygiaso is committed to the privacy of our Users and the confidentiality of their data. We strive to strengthen privacy and data protection and enable you to exercise your rights to your Personal Data. We minimise processing your personal data and what we know of you while providing you with our service you have chosen.

We manage personal data in compliance with the Swiss Federal Data Protection Act (FDAP) and the General Data Protection Regulation (GDPR). You can contact Us on data protection matters via dpo@shareguard.com.

In short, this is how we process your Personal Data (PD):

• We use your account and contact data to authenticate you and communicate with you.
• We will use your subscription data to limit your resource use within the subscription limits.
• Our payment service provider will use your payment method and details to settle your fees for paid subscriptions and fraud prevention.
• We will use contact data of transfer recipients and you to send digital communications, facilitate and notify these transfers.
• We will use keys and your transfer contacts to address and enable you to encrypt your transfers. We encrypt and store these keys in an encrypted and access-controlled database for you to use our service from anywhere, protected with your password that you hold. You control how you store your password.
• We use pseudonymous (e.g. device IDs), or aggregate analytics to improve the Application and prevent fraud.
• We use external partners to provide our service to you (e.g. authentication, cloud and payment services, analytics). To provide their services, they process personal data which they collect from you or which we share with them as necessary to provide you with our service. We do not permit our service providers to sell or use Your personal data for marketing purposes, nor do we do so, unless you explicitly agree to do so in the Application privacy settings.

We will not have any means to determine what you transfer, nor access to such transferred data. You are therefore fully responsible and accountable for what you transfer, the processing of any Personal Data that you may process using Our services and your compliance with all applicable laws, notably also data protection laws in doing so.

2. Scope and Applicability

This Policy applies to processing of Personal Data with the Application. The Application is released in Switzerland, and we require our subscribed Users to be based in Switzerland to use the Application.

3. How We Process Your Personal Data

This is how we process your personal data more specifically, depending on the service we provide for you:

3.1 Your Account

As a User you need an account. You can create a shareguard account with an associated email address for the Application, and we will confirm that You control this email account with a confirmation email. As a minimal standard, you must at least make use of a robust access control method to your account (strong password) to login and protect your data and access.

We use the email address linked to your account to communicate with you, e.g. to inform you on upcoming subscription roll-overs.

We process this personal data based on legitimate interest and as necessary to provide our service to you. We are the Controller of your account data but payment data which is controlled by our payment service provider.

3.2 Your Subscriptions and Payment

We will require you to record your payment method and details with our payment service provider for any payable subscription. This data is used to deter and prevent fraud or misuse of our Application by bots and for any subscription payments. Your payment details and personal identifiable information will not be shared with Hygiaso proactively, but information on what subscriptions you have paid, or cancelled will be available to Us for investigation purposes (e.g. in dispute or support cases). Our payment provider exchanges payment, payer data and device data with their partner institutions (e.g. your credit card company) for operation, verification, risk management and performance improvement purposes. For these purposes our certified payment provider shares this data also x-border between Switzerland, the EU and the US, offering adequate data protection under the established and approved Data Privacy Framework and/or approved Standard Contractual Clauses.

When you pay for your subscriptions, such payment is sent to an account of our payment provider, and We receive regular transfer of bulk amounts from them.

We process this personal data based on legitimate interest and as necessary to provide our service to you. We are the Controller of your subscription data, but our payment service provider controls your payment data.

You can find more details in the privacy policy of our payment provider (https://stripe.com/privacy).

3.3 Metering

We meter your personal resource consumption for storage and services (e.g. processing, up/downloads, storage) for every user and compare this to the quota limits of the corresponding subscription and limits We may set. We will notify you when you reach the limit of your subscription or technical limits imposed and block transfers beyond these limits. You can change or cancel your subscription anytime with effect as per the agreed terms.

We process this personal data based on legitimate interest and as necessary to provide our service to you. We are the Controller of your resource metering data.

3.4 Addressing Transfers and Communications

We use the email address you enter, or technical identifiers associated with the linked account or data to address communications and grant access to data if and when you have requested us to do so.

We process this personal data based on legitimate interest and as necessary to provide our service to you. We are the Controller of addressing information you provide.

3.5 Analytics & Marketing

We and our payment service provider use aggregate or pseudonymous analytics to better understand the use and usability of our Application and how to improve it.

We need to know whether you agree to such analytics and use service providers to collect this information based on legitimate interest.

If you have explicitly agreed to ("cookie") consent, we use service providers for the collection of stated analytics themselves.

If you have explicitly agreed, we may use cookies and analytics to display ads and send you emails based on these analytics via our service providers (Google and Brevo/Sendinblue). Note that these analytics do not include analytics of your own health data but the use of the Application.

We and our payment provider make use of the analytics services from providers, each described in their respective privacy policies.

We process this personal data based on legitimate interest and as necessary to provide our service to you, as well as based on your consent for related transfers or access to which you explicitly agree.

You can find more details in the privacy policy of our cloud providers (Microsoft Azure, Cloudflare).

3.6 Encryption

We will apply encryption at multiple levels to protect the data and safeguard privacy.

All data will be stored in encrypted databases and in the encrypted cloud storage at rest. Any remote transfer within the Application will be encrypted based on TLS/SSL encryption in transit and in addition will be encrypted in your local browser before it leaves your device and decrypted locally in your browser when you receive transfers.

Furthermore, the private keys themselves are also encrypted with a key derived from the user master key that the User will hold under their own control. We will therefore never have the key to read any User's private key, which we hold in our database. We therefore will not have any technical means to access your keys, nor information of the files transferred, and therefore no means to decrypt your data held or transferred with the Application.

Before your upload and from the download onward, you are responsible for that data, and where and how you store or further process this - at that time no longer encrypted data.

We process this personal data based on legitimate interest and as necessary to provide our service to you. We are the Controller of any of your encryption keys that we will hold for you. You will be the Controller of your own master encryption key.

3.7 Upload Data and/or Transfer to Another User

When you upload and/or a transfer data, this data will be encrypted and uploaded to the cloud to your dedicated storage. We use the User ID to ensure that only registered Users can upload data.

When you will share your data and/or transfer your data with another registered User of the Application, then You will use also the keys of the recipient to encrypt the data so that only the intended recipient will be able to decrypt the data shared. In this case, even if anyone intercepted the communication, they cannot decrypt the data.

Every User is allocated their personal cloud storage associated with their subscription and their individual resource consumption is metered. The cloud service providers have no access to the user accounts managed by the Application but only a pseudonymous identifier used for these purposes. They are a processor to Us for any personal data we provide to them.

In addition, the cloud service providers collect information such as IP addresses, traffic routing data, system configuration information and other information about traffic to and from Our Application, your device and/or network data to provide their services to Us and ultimately You and to prevent and counteract malicious activities. They are the Controller of the personal data that they collect themselves.

You are the Controller of the data that you transfer and evaluate, and responsible for what you transfer to whom. We process this personal data based on legitimate interest and necessity to provide our service to you.

You can find more details in the privacy policy of our cloud providers (Microsoft Azure and Cloudflare).

3.8 International Transfer of Data

If You access data or use our services from abroad, personal data is transferred to your device wherever you are (e.g. addressing, encryption or maybe the data you transfer itself), and you explicitly consent to such data being transferred also x-borders to your current location and jurisdiction. This also applies if You share data with a receiver who accesses the transfer from abroad.

This personal data is processed by our cloud and payment service providers and as necessary also transferred x-borders to different entities of theirs and their service providers as necessary to provide geo-redundant services within the constraints established and for administration and management purposes so that We can provide our service to You. You explicitly consent to such data being transferred internationally.

We use cloud service providers which offer adequate personal data protection should We or you transfer personal data. These service providers are established in Switzerland and/or the EU which offer mutually adequate data protection, and they are certified under the Swiss-US, EU-US and the UK extension of the GB-US Data Privacy Framework (DPF) and where they cannot rely on DPF such as for transfers to other countries, they use Standard Contractual Clauses from Switzerland, Europe and the UK. They offer adequate data protection for personal data that they transfer from Switzerland, the EU or the UK to the US or other countries as and where applicable.

Analytics service providers collect and transfer pseudonymous (e.g. device and/or session IDs) or aggregate information outside of Switzerland or the EU to provide their analytics services. Such data is not linked to your shareguard account or user ID. We use this data to understand the user journey and issues in our applications.

You control what you share with whom and if recipients are abroad also whether such transfers are x-border. We process this personal data based on legitimate interest and necessity to provide our service to you, as well as based on your consent for these international transfers.

You can find more details in the privacy policy of our cloud and analytics providers (Microsoft Azure and Cloudflare, as well as Stripe Privacy).

3.9 You Evaluating Your Data

When you have uploaded your data in your dedicated data vault, we process your data to de-identify and code it according to multiple schemas and make this data searchable and queryable in database for you. We use certified AI models to perform these transformations to safeguard your privacy and the confidentiality of your data.

We are the Controller of the data that you make available to us so you can use our data evaluation service. We process this personal data based on legitimate interest and necessity to provide our service to you.

You can find more details in the privacy policy of our cloud providers (Microsoft Azure).

3.10 Discovery for Public Health, Research & Clinical Studies

When you will choose to become discoverable and be notified of eligible studies, population health queries or research, we make the de-identified characteristics of your data available to our search and query service for evaluation. We do not share your personal data in this process.

If there is an eligible study or a request for you to join a project, we will notify you of such study or request, so that you can consider participation in privacy.

We are the Controller of the data that you make available to us so you can use our data discovery service. We process this personal data based on legitimate interest and necessity to provide our service to you.

You can find more details in the privacy policy of our cloud providers (Microsoft Azure).

4. Your Tasks and Processing Responsibility

The Application provides you with functionality to upload, store and evaluate and will also allow you to share data among Users. It is your responsibility to ensure that any entry of yours (files to upload and transfer, or recipients) with the Application are correct and reflects what you actually intend to perform.

You are fully accountable for any erroneous User activity, misuse, or abuse of the Application or inconsistent with the Application's Terms. It is your responsibility to correctly specify what you share with whom and what service you want to use.

As a User, you are the data subject of any administrative personal data and you self-determine and are responsible for what other Personal Data (if any) you process or transfer in the Application, whether you or someone else is the subject or person concerned. It is your responsibility as a sender of data to establish with the recipient of your data, what they are allowed or able to do, or what they must and must not do with your data.

If you are a Professional User and you use Our services to transfer personal data or exchange data with natural persons such as your staff, patients, business partners or clients, then you are the Controller of that personal data, and we process this data on your behalf. We provide a mere infrastructure service and will have no access to the personal data transferred. You remain responsible and solely accountable for the compliant processing and transfer of such personal data to any applicable laws and agreements, the safeguards and for the performance on the rights of the individuals concerned whose personal data you control.

If you are the receiver of personal data, it is your responsibility to process data received lawfully and as agreed with the sender. If you have received Personal Data, then it is your responsibility to also perform on any rights a data subject may have on the Personal Data you thereby collected, whether the data subject executes their right through the Application or outside.

If you download any data from the Application, you are the sole Controller of that data from then on and responsible for all related aspects.

5. Our Tasks and Processing Responsibility

As the Application provider and operator, We are responsible to process your Personal Data as instructed by you and described in this Policy, through the Application. We support you in meeting your obligations handling Personal Data. We maintain necessary records within our privacy by design remit and will inform you about our processing in support of your compliance obligations. We will notify you of any instruction, which we identify to be in conflict with data protection laws, and we will also notify any legitimate disclosure request we may receive to the extent we are permitted to do so. We are not accountable for you sending Personal Data to the wrong recipient, nor for transferring the wrong data, if this was specified like this.

Where we hold Personal Data of you as a User, we are responsible to perform on any legitimate request you may have (the data subject) to execute your statutory rights to your own data. For any data that our service providers collect and control themselves you should address your request to them directly.

6. Legitimacy of Personal Data Processing and Retention

The Application (Hygiaso) processes your personal data on different legal bases or justifications as outlined, depending on what type of personal data is being processed for what purposes.

We keep official documents to the extent required for as long as legally required for commercial records and transaction logs, i.e., 10 years. We hold your data on the Application for how long you as a User want to retain your own data in the Application or as specified in the subscription and we provide our service to you.

When you decide to share your or someone else's personal data with another person or organization using the service of the Application, then we process that personal data, knowingly or unknowingly on your behalf as a necessity to perform the service you request from Us using the Application.

Where applicable law provides, we also process certain personal data for legitimate interest purposes to manage the service we provide, we need to access technical device data, such as software and device versions, so we can well manage and improve our service to you.

7. Key Contacts and Roles

Controller and/or Processor (joint or separate as implied by the described responsibilities above)

GDPR Representation

We will appoint a GDPR representative in the EU from when we provide the shareguard file transfer service in the EU on a more than occasional basis.

Data Protection Officer

You can contact Us on shareguard data protection matters via dpo@shareguard.health.

Supervisory Authority

Federal Data Protection and Information Commissioner (FDPIC)
Feldweg 1
3003 Bern, Switzerland
Telephone: +41 58 462 43 95, Contact the FDPIC