Privacy policy

We would like to inform you of your rights as a data subject. These rights are set out in articles 15 – 22 EU GDPR and include:

• Right of access (Art. 15 EU GDPR): You have the right be provided with a copy of any personal data that we hold about you;
• Right to erasure / right to be forgotten (Art. 17 EU GDPR): You can request us, without undue delay, to delete your personal data collected and processed by us. In this case, we will ask you to delete the myoncare App including your UID (unique identification number) from your smartphone/mobile phone.  
• Right to rectification (Art. 16 EU GDPR): You can require us to update or correct any inaccurate personal data or to complete any incomplete personal data;
• Right to data portability (Art. 20 EU GDPR): In general, you can request us to provide you with personal data which you have provided to us and which are processed by using automated means, based on your consent or the performance of a contract with you, in machine readable format so that they can be “ported” to a replacement service provider.
• Right to restriction of data processing (Art. 18 EU GDPR): You can require us to “restrict” our use of your information, so that we can continue the use your information only subject to restrictions;
• Right to object to data processing (Art. 21 EU GDPR): You have the right to object to our use of your personal data and to revoke your consent at any time, if we process your personal data based on your consent. We will continue to provide our services if they do not depend on the consent that has been revoked.

To exercise these rights, please primarily contact your Health Care Provider or your Company or us at privacy@myoncare.com. We will require you to provide satisfactory proof of your identity to ensure that your rights are protected and that your personal data is disclosed only to you and not to any third person.

Please also contact us at any time at privacy@myoncare.com, if you have questions about data processing in our company or if you wish to revoke your consent. You also have the right to contact the relevant data protection supervisory authority.

‍

– Applicable to all App Users –

You might provide us with certain personal data in case you are contacting us to understand or discuss the functions and usage of the App or in case of a service request.

In the event of a service request, the following personal data may also be viewed by authorized Oncare employees:

• The personal data that you have provided to your Health Care Provider through our App (e.g. name, date of birth, profile picture, contact details)
• The health information you have provided to your Health Care Provider, the Data Service Provider or Company through our myoncare App (e.g., information about medications taken, responses to questionnaires including disease-related or condition-related information, diagnoses and therapies provided by health care professionals, planned and completed tasks)

Authorized Oncare employees who have access to your Health Care Provider’s, Data Service Provider’s or Company’s database for the purpose of processing a service request are contractually required to keep all personal information strictly confidential.

When myoncare App is downloaded, the necessary information is transferred to the app store provider. We have no influence on this data collection and are not responsible for it. We process the personal data provided to us by the provider of the app store within the framework of our contractual relationship for the purpose of further developing our myoncare Apps and Services.

For the processing of Operational Data, Oncare acts as data controller responsible for the legitimate processing of your personal data.

Types of Data: Your name, e-mail-address, date of birth, registration date, pseudo keys generated by the app; device token to identify your device, your pseudo identification number, your IP address, type and version of the operating system used by your device.

The app uses Google Maps API to use geographical information. When using Google Maps, Google also collects, processes and uses data about the use of the map functions. For more information about the scope, legal basis and purpose of data processing by Google as well as the storage period, please refer to Google’s privacy policy.

Purposes of processing of Operational Data: We use the Operational Data to maintain the functionalities of myoncare App and to get in direct contact with you if required or initiated by you (e.g. in case of change of Standard Terms, necessary support, technical problems etc.).

Justification of Processing: The processing of Operational Data is justified based on Article 6 Paragraph 1 lit. b EU GDPR to fulfill the contract you conclude with Oncare for the purpose of the use of myoncare App.

– Applicable to App Users using the App with their Health Care Provider –

During the use of myoncare App, your doctor, a clinic or other health care provider treating you (“Health Care Provider”) will enter your health information / personal data to myoncare Portal to start myoncare Services (e.g. provision of individual Careplan, reminder for intake of medicines etc.). In addition, you and your Health Care Provider will be able to upload documents and files related to you to myoncare App and myoncare Portal and can share the files with the other. Your Health Care Provider can upload a privacy policy for your information and define other consent requirements for you as a patient, for which your consent must be given. The files will be stored in a cloud database hosted in Germany. Your Health Care Professional can allow sharing such files with other Portal Users of his institution for medical reasons, but other Portal Users will not be able to access the files.

Your Health Care Provider will be responsible for a legitimate processing of the health information / personal data.

We process such health information / personal data, including your health data, under an agreement with and in accordance with the instructions of your Health Care Provider. For the purposes of this agreement, the Health Care Provider is responsible of processing your health information / personal data and health data within the meaning of applicable data protection laws. This means that Oncare processes the health information / personal Data only according to the instructions of the Health Care Provider. If you have any questions or concerns regarding the processing of your health information / personal data or health data, you should primarily contact your Health Care Provider.

Types of Data: Name, date of birth, profile information, contact details and also health data, such as symptoms, photos, information about medications taken, responses to questionnaires including disease-related or condition-related information, diagnoses and therapies provided by health care professionals, planned and completed tasks.

Purposes of Treatment Data processing: We process your Treatment Health Information / Data to be able to provide our myoncare Services to your Health Care Provider and to you. Your health data, which you enter in our myoncare App, will be used by your Health Care Provider for consultation and support to you. We process this health information / personal data as part of an agreement with and in accordance with the instructions of your Health Care Provider. The transmission of this Treatment Data is pseudonymized and encrypted. To exercise your rights as a data subject, please contact your Health Care Provider.

Your doctor will be responsible to obtain your consent. Even if you can use myoncare App without such consent, most of the functions will not work anymore (e.g. sharing of data with your Health Care Provider). Therefore, denial or revocation of consent to process Treatment Health Information / Data will lead to a heavy limitation of functionality of the App services and your doctor will not be able to support you via myoncare App anymore.  

GDPR Rules

Justification of processing of Treatment Health Information / Data: Your personal health information / data will be processed by your Health Care Provider in accordance with the provisions of the EU GDPR and all other applicable data protection regulations. Legal basis for data processing in particular arise from Art. 9 Paragraph 2 lit. h EU GDPR for health data as special sensitive data as well as your consent according to Art. 6 Paragraph 1 lit. a and 9 Paragraph 2 lit. a EU GDPR. The processing of data by Oncare for your Health Care Provider is, in addition, based on Art. 28 GDPR (data processing agreement) 

Personal Data will only be transferred to third countries if this is necessary for the performance of the contractual obligation, is required by law or you have given us your consent

Synchronization of myoncare App with myoncare Portal takes place via Google Firebase. The Google Firebase servers are hosted in the EU. However, according to the Google Firebase Terms of Service, transient data transfers in countries where Google and its’ service providers have establishments are possible; in the case of certain Google Firebase services, data is only transmitted to the US, insofar as no processing takes place in the European Union or the European Economic Area. Unauthorized access to your data is prevented by end-to-end encryption and secure access tokens. Hetzner Online is hosted in Nuremberg, Germany.

In order to process Activity Data, interfaces to Google cloud services (in case of GoogleFit) or to AppleHealth within the mobile device of the App User are used. myoncare Tools use these interfaces which are provided by Google and Apple, to request Activity Data from connected Health Apps. The request sent by myoncare Tools does not contain personal data but personal data is provided to myoncare Tools via these interfaces.