Privacy Policy

1. Privacy policy

Privacy Policy of National Diagnostic Products Pty Limited, 7-9 Merriwa Street, Gordon, NSW 2072, Australia (“NDP”, “we”, “us”), regarding the apps offered by iOS and Android (“App”) and all data processing activities performed within the App.

i. Protecting your privacy is a high priority for us. The following statement is intended to provide you with comprehensive information about what (personal) data we collect when you use our app, how we handle it, and what rights you have in this context. Our privacy policy is in accordance with the General Data Protection Regulation of the European Union (GDPR).

ii. When processing personal data, the data protection regulations must always be observed. For the scope of this privacy policy, the definitions of the GDPR are valid. Thus, the “processing” of personal data essentially includes any handling of them. Insofar as the data processed by us is personal data and – even if only through third parties or additional knowledge – makes you recognizable as a person (in particular, makes your full name recognizable), it is considered personal data.

2. Data processing from your use of the app

When you install and start our app on a mobile device, your IP address and other metadata that allow us to draw general conclusions in connection with the use of our app may be automatically collected and processed. The explanations under point 1 apply analogously. This also includes device-specific information (device ID, operating system, platform).

This data processing is based on the overriding legitimate interests of NDP (Art. 6 para. 1 f DSGVO) and enables us, among other things, to continuously improve the quality of our app and to provide the best possible service to our users.

Moreover, the app does not require any special permission from you, which is why we do not have access to personal information (e.g. the address book).

Entering personal identifying information is not required to use the app. You may choose to enter personal data to manage the uploaded results and to assist you in transferring these results via email. If you do not enter personal data, we will process your data as described in points 1 and 2.

3. What kind of data?

In the course of using the app, you may choose to enter the following information. Although this data is stored locally on your mobile device, it may be accessed by us for the purpose of providing the services of the App. The data we collect and process (in addition to the data mentioned in point 1):

• Your first name
• Last name
• Date of birth
• E-mail address
• IP address

4. On what legal basis and for what purpose is the data processed?

• For username, first name, last name, e-mail address: unique identification of the user.
• For IP address: Fraud prevention, blocking capability, country access tracking.

5. Advertising and your personal data

• No advertising is displayed in the app.
• No personal data is sold or shared with advertisers.
• No usage statistics, behavior patterns, or preferences for advertising are recorded.

6. Storage and deletion of personal data

Your personal identification data will only be stored by us for as long as we deem necessary within the reasonable scope for the execution of the app and as permitted by applicable law. In any case, we store the personal data as long as legal retention obligations exist or statutes of limitations for possible legal claims have not yet expired. If the storage of the data is no longer necessary for the purposes of the original collection (or within the scope of a legally permissible change of purpose) and there are no legal provisions to the contrary, we will arrange for the deletion of the data. For this purpose, we have implemented a deletion concept that protects all personal data.

7. Transmission of personal data by us

For the purposes explained in this Privacy Policy, we will share your personal information with recipients in the following categories:

• Within our organization to those employees who need the data based on our legitimate interests.
• External contractors engaged by us when they need the data to provide their respective service for the development and maintenance of the App or related activities. All contractors are contractually obligated to keep your data confidential and to process it only in the course of providing services.

8. Uploaded test result data

When you use the app, your personal test results are sent from your Betachek® blood glucose meter to the app loaded on your mobile device. They can then be displayed and analyzed in tables and charts. The “test results” include the results of the blood glucose measurement with time, day, date, notes, symbols, batch number of the test cassette and expiry date.

• These uploaded test results are stored locally on your mobile device.
• They are not stored on our servers and they are not stored in the “cloud”.
• The test results are not transmitted to us and are not collected by us.
• The test results are not accessible to us.

Test results are uploaded from your Betachek® blood glucose meter to your mobile device via Bluetooth.

• Bluetooth pairing security: uploading can only occur after the two devices are “paired”. To pair the devices, the user must have control of both devices.
• Bluetooth results upload security: Results can only be uploaded from the Betachek® meter to the app when the two devices are actively operating at the same time.

Security measures to protect the meter from unauthorized pairing and/or unauthorized uploading to the app are in accordance with industry standards for equivalent devices using Bluetooth and require the simultaneous use of multiple devices in close proximity.

9. Your test result data: Transmission by you

When you use the app, you can choose to send your test results to your doctor or a healthcare professional. This can be done by email using your doctor’s or healthcare professional’s email address. This does not happen automatically. You must actively select this option and perform the email transfer each time you want to send your results.

If you select this option, your test results will be transferred from your mobile device to the email address of the recipient of your choice. NDP is not involved in this data transfer between your personal mobile device and your physician or healthcare professional via email. It is recommended that you only use this feature with the prior consent of your physician or healthcare professional.

10. Rights of the data subject

A central aspect of the data protection provisions is the possibility of deleting personal data even after it has been processed. For this purpose, a number of rights of the data subject are established. NDP will comply with your relevant requests to exercise your rights without undue delay. To exercise your rights, please contact us at the following e-mail address: support@betachek-europe.com.

Specifically, the rights are as follows:

a. If you exercise your right to information and there are no legal restrictions, we will inform you in detail about how we process your data. To this end, we will send you (i) copies of the data as well as information about (ii) specifically processed data, (iii) purposes of processing, (iv) categories of data processed, (v) recipients, (vi) the retention period or criteria for determining it, (vii) the origin of the data, and (viii) other information, if any. Please note, however, that we cannot hand over documents that may affect the rights of other persons.

b. With the right to correction, you can request that we correct incorrectly recorded, inaccurate or incomplete data.

c. The right to (data) erasure may be exercised (i) in case of lack of necessity for processing purposes, (ii) in case of withdrawal of consent given by you, (iii) in case of specific objection, provided that the data processing in question is based on the legitimate interests of the NDP, (iv) in case of unlawful data processing, (v) in case of a legal obligation to erase and (vi) in case of data processing by minors under 16 years of age.

d. In special cases, there is an accompanying right to restrictions, after the exercise of which the data in question may be stored. In addition to the possibility of limiting the review period for data corrections, (i) unlawful data processing (if no deletion is requested) and (ii) the duration of the review of a special request for objection are covered.

e. With the right to data portability, you can request to receive the data in a structured, commonly used and machine-readable format and to transfer this data to another controller.

f. In addition, you have the right to object to data processing. However, this only applies if the processing is not based on NDP’s legitimate interests. You may also exercise your right to object to the supervisory authority.

g. Please also note that we may not be able to comply with your request for compelling legitimate grounds for processing (balancing of interests) or processing due to the assertion, exercise or defense of legal claims (on our part). The same applies in the case of excessive requests, whereby a fee may be charged here as well as for the processing of obviously unfounded requests.

11. Data security

NDP takes all appropriate technical and organizational measures to ensure that, by default, only personal data whose processing is absolutely necessary for business purposes is processed. The measures we take relate to the amount of data collected, the scope of processing, as well as its retention period and accessibility. Based on these measures, we ensure that personal data is only made available to a narrowly defined and necessary group of persons by default. Under no circumstances is access to personal data granted to other persons without the express consent of the data subject. In addition, we use various protection mechanisms (backups, encryption, etc.) to secure our app management systems. This is to best protect your (personal) data from loss or theft, destruction, unauthorized access, modification and dissemination.

All NDP employees have been adequately informed about all applicable data protection regulations, internal data protection provisions and data security measures and are obliged to keep confidential all information entrusted or provided to them in the course of their professional activities. The requirements of the GDPR are strictly adhered to and personal data is only made available to individual employees to the extent necessary with regard to the purpose of the data collection and our resulting obligations. Insofar as we use contractual partners, they are also obliged to comply with all applicable data protection provisions on the basis of specific framework agreements. In addition, they are strictly bound by our guidelines, in particular with regard to type and scope, when handling your (personal) data.

12. Right to appeal

If you believe that we are in breach of applicable data protection laws when collecting your data, you have the right to lodge a complaint with the competent national data protection authority. The requirements for such a complaint depend on the respective national implementation law of the GDPR, as the GDPR itself does not provide any regulation in this regard. However, we ask you to contact us in advance to clarify any questions or problems.

13. Contact details for data protection issues

If you have any questions or requests regarding our privacy practices, or if you wish to exercise your rights of access, correction, or deletion, please send us a written request outlining your wishes:

National Diagnostic Products Pty Limited
7-9 Merriwa Street,
Gordon, NSW 2072
Australia
E-mail: support@betachek-europe.com