Privacy Notice

Index

1. Introduction
2. What information does Healthwords collect about me?
3. How does Healthwords use your personal information?
1. What promotional updates and marketing communications might we send you?
2. Does Healthwords use cookies & similar technologies?
3. What device permissions does Healthwords use?
4. What is aggregated data, and how does Healthwords use it?
5. What are Healthwords legal grounds for using your data?
4. How does Healthwords share your information?
5. What happens if Healthwords links to an external site?
6. Where does Healthwords store your personal information?
7. How long does Healthwords keep your information?
8. Payment processing
9. How does Healthwords protect your information?
10. What is Healthwords's approach to child safety?
11. Intellectual Property Rights
12. What rights do you have?
13. When did Clinova last update this Notice?
14. How can I contact Clinova?

1. Introduction

We are Clinova Limited (or simply “Clinova”). Clinova is a UK based, global digital healthcare company providing health and wellness solutions. Healthwords is our flagship digital product. Throughout this Notice "we", "us", "our" or "Healthwords" means Clinova Limited (including our Healthwords app). Clinova is registered with the Medicines and Healthcare products Regulatory Agency ("MHRA") as a manufacturer of a Class 1 Medical Device (for our app, as patient health self-management software).

"You" and "your" mean you, the person reading this Privacy Notice. We know that you are trusting us with certain pieces of information about you. In what follows, we have taken care to explain how we use this information. Clinova is committed to making the world a healthier place while making sure our actions are not only legal, but ethical, moral, and just. When it comes to your data, we strive to go above and beyond to protect your privacy. You can read more about our core values in the Clinova credo, which is also on our website.

2. What information does Healthwords collect about me?

We collect information from you, from other organisations and automatically via our Platform if you:

• use our Symptom Check feature
• use our Me section
• have an Allergy & Health Test, or a Food Intolerance Test
• use our Travel Health feature
• use our Sexual Health feature
• use our Mental Health feature
• use our Fit Note feature
• use our Healthwords Plus feature
• use our period/ovulation tracker
• use the Platform to upload or submit any information
• use our app in conjunction with our Healthwords Now machines
• use our Shop
• request any information
• interact with us on social media
• enter into any competition/promotion we may sponsor
• report a problem to or submit queries, concerns or comments regarding the Platform or its content; or
• respond to, or participate in, surveys that we may, from time to time, run on the Platform for research purposes.

We explain what categories of information we collect (and how) in this section, and what we do with each of the categories in the next section.

You provide us with the following categories of information about you

• Log-in: the phone number or email address, and password for your Healthwords account
• Contact: basic contact information, such as your name, title/role, email address & home address, billing information (such as your registered billing address) and shipping details
• Identity: additional information you provide, including your gender, assigned sex at birth, date of birth, and photos of you (for example, to use our dermatology feature), as well as certain pieces of accompanying meta-data (information attached-to and/or regarding items of data, e.g. the location of where you took a photo or the date and time you updated your billing address)
• Health: including
  • anything you tell us about your symptoms
  • any assessment(s) information generated when you complete a Symptom Check journey
  • any information you give us relating to your medical history, including information about
    • your lifestyle, specifically
      • information you tell us about your exercise habits
      • information you tell us about your smoking and/or drinking habits
    • any medications you currently take
    • any pre-existing or long-term health conditions you have
    • any allergies or intolerances you have (including hay fever)
    • whether you are pregnant or breastfeeding
    • vaccinations you have had or plan to have
    • your sexual health
    • whether you are pregnant or breastfeeding
    • vaccinations you have had or plan to have
    • your sexual health
• Communications: records of any correspondence and communications if you contact us, including information regarding any questions, comments, or concerns you have with our Platform. This covers information we learn about if you speak with us via:
  • in-app messaging
  • emails
  • texts
  • letters
  • calls
  • the @Healthwords_ai or @clinova Twitter pages
  • the Healthwords or Clinova Facebook pages
  • the @healthwords.ai Titkok pages
• Marketing: you may also provide us with your personal direct marketing and notification preferences (e.g. if you would like to receive promotional emails or texts from us)
• Financial information: our payment processing partners may get some financial and credit card information from you if you purchase something via our Platform, but we won't see this information

We automatically collect the following categories of data from you each time you use our Platform, including

• Technical information, like your device ID (which we generate for you when you join and is unique to your device) and IP address (which you already have and may be uniquely associated with your device)
• Information about your visit, such as information about your interactions with our Platform, including how long you spend on our Platform, where and when you use our Platform, details of your journey through our Symptom Check feature, and what assessments and recommendations are generated

Pending your explicit approval, we will automatically collect the following categories of data from you each time you use our Platform

• Location data, based on your IP address, geo-spatial coordinates, or a unique code associated with your device
• Technical information may include:
  • phone number
  • Internet Protocol (IP) address
  • login information
  • browser type and version
  • browser plug-in types and versions
  • device IDs
  • Google ID/email address
  • time zone setting
  • operating system and platform
  • hardware version
  • device settings (e.g. language and time zone)
  • file & software names and types (associated with your device and/or the Platform)
  • battery & signal strength
  • information relating to your mobile operator or Internet Service Provider (ISP)
• Information about your visit may include
  • full Uniform Resource Locators (URLs)
  • clickstream to, via, and from our Platform (including date and time) (e.g. how you found our Site)
  • page response times & download errors
  • page interaction data (including data relating to scrolling, clicks, length and frequency of visits, type of content engaged with, and mouse-overs)
  • methods used to browse away from the page
  • tracking pixel data about how you engage with emails (when an email is opened, how long it is open for, and when it is deleted).

• Location data will include specific geographic locations (such as through GPS, Bluetooth, or WiFi signals) which we use (if you ask or permit us to), so that we can deliver content, advertising or other Platform features that are dependent on knowing where you are, like showing you where your closest chemists/pharmacies, doctors or travel clinics are, or providing local pollen alerts.

  Location data may be collected in combination with device ID so that we can recognise your mobile browser or device when you return to the Platform.

  Delivery of your location to the Platform will involve us checking any of the following:

  • your coordinates (latitude, longitude, and altitude), speed, and bearing, each of which may include complementary pieces of meta-data (e.g. the time your location is logged, the accuracy of a given location reading, and the name of the service providing your location-data);
  • the country you are in when you use our Platform (which is done by referencing your current IP address against public sources); and/or
  • your Identifier for Advertisers (IFA) code for your Apple device, or the Android ID for your Android device, or else some other similar device identifier.

Remember, you are always free to opt-in or opt-out of location sharing.

Hotjar

We use Hotjar in order to better understand our users’ needs and to optimize this service and experience. Hotjar is a technology service that helps us better understand our users’ experience (e.g. how much time they spend on which pages, which links they choose to click, what users do and don’t like, etc.) and this enables us to build and maintain our service with user feedback. Hotjar uses cookies and other technologies to collect data on our users’ behavior and their devices. This includes a device's IP address (processed during your session and stored in a de-identified form), device screen size, device type (unique device identifiers), browser information, geographic location (country only), and the preferred language used to display our website. Hotjar stores this information on our behalf in a pseudonymized user profile. Hotjar is contractually forbidden to sell any of the data collected on our behalf.

For further details, please see the ‘about Hotjar’ section of Hotjar’s support site.

3. How does Healthwords use your personal information?

This section explains the different purposes we use your personal information for, the types of personal information we use for each purpose, and the legal reason(s) (or the "legal basis") for each purpose.

We may process your personal information for multiple purposes and legal bases.

Below is an explanation of what each legal basis means.

We may use the categories (explained in the previous section) as follows:

• You provide us with
  • Log-in
  • Contact
  • Identity
  • Health
  • Communications
  • Marketing
  • Financial information
• We automatically collect
  • Technical information
  • Information about your visit
  • Location data

3.1 What promotional updates and marketing communications might we send you?

3.2 Does Healthwords use cookies & similar technologies?

3.3 What device permissions does Healthwords use?

You may provide us with the certain device permissions if you use our Platform on a mobile device.

3.4 What is aggregated data, and how does Healthwords use it?

We may anonymise or pseudonymise, and aggregate any of these categories of information, including identity, and automatically collected information.

Our use of aggregated information (such as statistical data or customer profile information) is critical to our understanding of how users engage with our Platform for the purposes of improving it. This information significantly enhances our ability to optimise development of our Platform and bring greater benefits to our users.

We may provide some aggregated data to our partners or other third parties in relation to the products or services that they provide, or to promote our Platform. Where this aggregate information is derived from your personal data, we will ensure that your personal data is removed so that you cannot be re-identified from aggregate information retained or used for these purposes.

While our anonymisation and aggregation of data is based on our legitimate interest in developing and improving our services, you may let us know if you would prefer we do not use your data for this purpose. This will not affect any data which has already been anonymised, but it will stop your personal data being used for this purpose going forward. Please contact us at info@clinova.co.uk if you would like to ask about your data not being used to help us improve and develop our Platform and services.

3.5 What are Healthwords's legal grounds for using your data?

In accordance with applicable data protection law, we rely on one or more of the following grounds when processing your data:

4. How does Healthwords share your information?

We may share your personal information with:

• our online prescribing, pharmacy and fulfilment partners
• For Healthwords Direct orders, our partners may require your contact information. For safe and legal drug supply, our partners may require a clinical assessment form for pharmacy-only or prescription items. Registered healthcare practitioners must evaluate the information on the form to assess and supply the medicine legally. Our partners will only use your information to fulfil your order and meet necessary regulatory requirements.
• companies within the Clinova group who may support us in any of the purposes set out in this Privacy Notice
• payment processing providers who provide secure payment processing services
  • analytics and search engine providers that assist us in the improvement and optimisation of our Platform, including by
    • measuring the performance of our online campaigns and analysing visitor activity, as explained in point 3.1,
    • facilitating feedback on our Platform, and
    • providing IT support for our Platform

These organisations will only use your information to the extent necessary to perform their support functions to us, and with appropriate contractual protections.

• any appropriate third party we work with, including but not limited to business partners, customers, suppliers and sub-contractors, for the performance of any contract we enter into with you that assist us in the improvement and optimisation of our Platform, including by
  • providing a website and data hosting platform,
  • distributing communications we send,
  • supporting or updating marketing lists,
  • facilitating feedback on our Platform, and providing IT support for our Platform

These organisations will only use your information to the extent necessary to perform their support functions to us, and with appropriate contractual protections.

We will also share your personal information with third parties:

• If we sell or buy any business or assets, in which case we will disclose your personal information to the prospective seller or buyer of such business or assets subject to the terms of this privacy policy
• If Healthwords or substantially all of its assets are acquired by a third party, in which case personal information held by it about its customers will be one of the transferred assets
• to protect the rights, property, or safety of Healthwords, our customers, or others. This includes exchanging information with other companies and organisations (including law enforcement agencies or other similar government bodies) for the purposes of fraud protection and credit risk reduction and to prevent cybercrime
• If we are under a duty to disclose or share your personal information in order to comply with an applicable court order or any other legal obligation, or in order to enforce or apply our terms and other agreements with you

5. What happens if Healthwords links to an external site?

The Platform may, from time to time, contain links to external sites, including links to purchase medications from our online pharmacy partners and links to open up your mobile devices' map app.

We are not responsible for the privacy notices or the content of such sites. Your use of external sites will be governed by their respective terms and privacy information.

6. Where does Healthwords store your personal information?

We are based in the United Kingdom (UK). We may transfer your personal information to one or more countries outside the UK (including to the EEA), where we (or other companies within the Clinova group) or our Platform providers maintain operations. We will take steps to ensure that your data is held safely in such circumstances.

The servers used to process your personal information collected from this website are located in the United Kingdom, but we collect data from wherever users are situated. The information that we collect may therefore be transferred to the United Kingdom from any other country in which you may be located.

Why do we transfer it?

We may transfer your personal information outside the EEA

• in order to store it
• in order to enable us to provide our Platform to you and fulfil our contract with you
• in order for us to provide goods to you and fulfil our contract with you (e.g. if you use Healthwords Direct). This includes order fulfilment, processing of payment details, and the provision of support services
• where we are legally required to do so
• in order to facilitate the operation of our group of businesses, where it is in our legitimate interests and we have concluded these are not overridden by your rights.

7. How long does Healthwords keep your information?

Your personal information will be kept by Healthwords:

• for as long as you have the Healthwords app, and
• for six years after you delete the Healthwords app or close your Healthwords account. This retention period allows us to monitor issues and, if necessary, address any legal proceedings that relate to our Terms & Conditions (which you have agreed to) and maintain our legitimate operations safely and legally. This may include keeping personal information required for our tax reporting requirements, to comply with the expectations of financial and data protection regulators, to help prevent fraud and other financial crime, and to enforce the relevant terms of agreement or otherwise identify, issue or resolve legal proceedings.

If you opt-out of our sending you promotional updates and marketing, or if you object to any other processing of your personal information, we may keep a record of your objection for the legitimate purpose of ensuring that we can continue to respect your wishes and not contact you further during the term of your objection.

We may retain aggregate information indefinitely, for research purposes and to help us develop and improve our Platform. You can never be identified from aggregate information retained or used for these purposes.

7. How long does Healthwords keep your information?

Your personal information will be kept by Healthwords:

for as long as you have the Healthwords app, and

for six years after you delete the Healthwords app or close your Healthwords account. This retention period allows us to monitor issues and, if necessary, address any legal proceedings that relate to our Terms & Conditions (which you have agreed to) and maintain our legitimate operations safely and legally. This may include keeping personal information required for our tax reporting requirements, to comply with the expectations of financial and data protection regulators, to help prevent fraud and other financial crime, and to enforce the relevant terms of agreement or otherwise identify, issue or resolve legal proceedings.

If you opt-out of our sending you promotional updates and marketing, or if you object to any other processing of your personal information, we may keep a record of your objection for the legitimate purpose of ensuring that we can continue to respect your wishes and not contact you further during the term of your objection.

We may retain aggregate information indefinitely, for research purposes and to help us develop and improve our Platform. You can never be identified from aggregate information retained or used for these purposes.

8. Payment processing

Payments on the Platform are made through our payment gateway provider, Stripe. When you make a purchase via our Platform, we will provide credit or debit card information directly to Stripe which operates a secure server to process payment details, encrypting your credit/debit card information and authorising payment. Information which you supply to Stripe is not within our control and is subject to Stripe's own privacy policy and terms and conditions.

9. How does Healthwords protect your information?

We take reasonable steps (including physical, technical and organisational measures) to protect your personal information from unauthorised access and against unlawful processing, accidental loss, destruction and damage. We offer industry-standard practices and security measures to safeguard and secure the personal information we collect. Our security policies and Notice are periodically reviewed and enhanced as necessary and only authorised personnel have access to personal information.

Unfortunately, transmission of information via the internet is not perfectly secure. Although we do our best to protect your personal information, we cannot guarantee the security of your personal information submitted to us and any transmission is at your own risk.

10. What is Healthwords's approach to child safety?

Protecting the safety of children when they use the Internet is important to us.

Our Platform is intended for use only by persons who are at least 16 years of age.

If you are under the age of 16 your parent or guardian must consent on your behalf where we ask for consent in relation to the use of your information.

11. Intellectual Property Rights

All intellectual property rights in any content of the Platform (including text, graphics, software, photographs and other images, videos, sound, trade marks and logos) are owned by us or our licensors.

Except as expressly set out here or in our Terms, nothing in this Notice or our Terms gives you any rights in respect of any intellectual property owned by us or our licensors and you acknowledge that you do not acquire any ownership rights by downloading content from the Platform.

You may not print off, copy, store or otherwise replicate pages from the Platform (in whole or in part) without our express prior permission. In the event you print off, copy, store or otherwise replicate pages from the Platform (only as permitted by us), you must ensure that any copyright, trade mark or other intellectual property right notices contained in the original content are reproduced.

12. What rights do you have?

You have options and choices over how we use your personal information

If you wish to exercise any of these rights in relation to the personal information we hold about you, or wish to change your preferences at any time, please contact us:

• By email at: info@clinova.co.uk
• By writing to us at:
  Clinova Ltd.
  International House
  Southampton International Business Park
  George Curl Way
  Southampton SO18 2RZ

Please note that we may require you to verify your identity before allowing you to access your personal information.

If you remain unhappy with a response you receive from us, you can also refer the matter to your data protection supervisory authority:
https://ec.europa.eu/justice/data-protection/bodies/authorities/index_en.htm

The Information Commissioner is the supervisory authority in the UK and can provide further information about your rights and our obligations in relation to your personal data, as well as deal with any complaints that you have about our processing of your personal data.

13. When did Clinova last update this Notice?

Any changes we make to this Notice will be posted on this page and, in relation to substantive changes, will be notified to you by e-mail.

This policy was last updated on 7 January 2021.

14. How can I contact Clinova?

If have any questions about this Privacy Notice, please contact us:

• By email at: info@clinova.co.uk
• By writing to us at:
  Clinova Ltd.
  International House
  Southampton International Business Park
  George Curl Way
  Southampton SO18 2RZ