CMED Health Ltd has developed and is managing ‘SuSastho’ mobile & web application and services in order to provide digital health services including but not limited to digital health account, primary health screening, telemedicine and health record storage. When you use ‘SuSastho’ mobile or web application, some personal information will be collected about you. Please read the following carefully to understand our views and practices regarding your personal data that we collect during using our services using ‘SuSastho’ (App & Web) and how we will treat it. This Privacy Policy may be revised from time to time. By accessing or using our Services, you accept the practices and policies outlined in this Privacy Policy. You hereby consent that we will collect, use and disclose your Information as set forth in this Privacy Policy. If you are using our Services on behalf of an individual other than yourself, you represent that you are authorized by such to accept this Privacy Policy on such individual’s behalf. Your use of our Services using ‘SuSastho’ (App & Web) means you accept the Privacy Policy. If you do not agree to the terms of this Privacy Policy, please do not use the Services.

1. KEY PRIVACY PRINCIPLES

We are committed to upholding industry-leading standards when processing and protecting your information. These are our key data privacy principles:

• We shall use the information that you give to us, or that we otherwise collect about you, in a fair and consistent way and in ways that will enhance the Service you receive or to provide you any information or notification;
• We shall always comply with applicable law and regulations when using information about you;
• We take information security very seriously. Although no system can be 100% secure, we will do our best to keep your information safe;
• Data about you is your Information, and we will treat it as such;
• We will always be open with you about how we use your information;

2. PERMISSIONS REQUESTED FOR

We may request for some user permission including Access Location, Internet, Network State, Write External Storage, Call/Phone Access, Bluetooth, Audio from our apps. We do not access or collect any such data until we receive the user consents. We do not share these permissions and user data to others.

3. INFORMATION WE MAY COLLECT

We may collect and process some personal information from you like,

• your name and contact information (phone number, address, etc.),
• identification information (such as national ID or passport),
• your login and password,
• demographic data (such as your gender, date of birth, location, comorbidity, etc.) and
• the location of your device through which you access our Services.

For the purposes of this Privacy Policy, all Personal User Information as defined above, shall together be regarded as your “Information”. You represent and warrant that all the Information you provide in relation to obtaining the Services is true, accurate, current and complete and you agree to maintain and promptly update such Information, as and when necessary, to keep it current.

4. THE WAY INFORMATION IS COLLECTED

When you register for service using ‘SuSastho’ mobile or web application, your personal information as mentioned in clause 3 is collected and a system-generated unique id (User ID) is assigned to you. The information collected from you and your User ID during registration or taking service from our service providers is stored securely on a server managed by DigitalOcean, LLC on behalf of CMED Health. The information stored on the DigitalOcean Cloud Server will be stored against your unique id (User ID) that is pushed to your App. The User ID will thereafter be used to identify you in all subsequent App related services and will be associated with any data or information uploaded from the App to the Server. We only access personal and sensitive data required to provide you with health services, or to support the public health emergency, and may use the data collected to support any research related to health service, health service improvement and reporting.

5. USE OF INFORMATION

The personal information collected from you at the time of registration will be stored on the DigitalOcean Cloud Server and only be used by CMED Health, or any of its authorized employee or agent or service provider for the purpose of providing you required health services or its improvement, generating reports and other statistical visualizations for the purpose of the management of health service system or to provide you general notifications pertaining to health services as may be deemed required for your health service. Your User ID will only be co-related with your personal information in order to medical service and administrative interventions necessary in relation to health service, the information they might need about you in order to be able to perform their job. More specifically for

• verifying your identity, processing your payments and fulfilling your request/orders;
• ommunicating with you about our Services or your use of our Services, and sending you communications on behalf of your Providers;
• ensuring quality customer service by providing you with customer support, responding to your requests or concerns, ensuring that our Services functions properly for you and tailoring our Services to meet your needs;
• enhancing the experience of Services which may include analysis of your data and application of algorithms to provide assistance such as relevant recommendations, advice and new products;

You acknowledge and accept that we may use your Information to improve the Services which we provide to you and this may include aggregating and/or anonymizing your data for analytical purposes.

6. RETENTION

1. All personal information collected from you at the time of registration or during providing you services, will be retained as long as your account remains in existence or we have an ongoing legitimate business need to do so, such as, to provide you with a service you have requested or to comply with applicable legal, tax, or accounting requirements, under any law for the time being in force.
2. All information collected and uploaded to the Server may be purged from the Server if the data is deemed to have no further value in terms of providing you service.
3. Nothing set out herein shall apply to the aggregated datasets generated by the personal data of registered users of the App or any reports or other visualization created using such datasets. Nothing set out herein shall apply to medical reports, diagnoses or other medical information generated by medical professionals in the course of treatment.

7. RIGHTS

As a registered user you have the right to cancel your registration at any time by sending an email to info@cmedhealth.com. If you decide to cancel your registration the information already provided by you will be retained or deleted as per Clause 6 of the Privacy policy. Barring cancellation of registration, the user would not have any control of how they receive the communications from us or the way the communication is received.

8. DATA SECURITY

Our system is GDPR and HIPAA aligned. In-app consent capture and audit logs are maintained. The App is equipped with standard security features to protect the confidentiality and security of your information. We are committed to and take great care in ensuring that your Information is secure. This includes physical security measures, as well as password-controlled access and audit trails. In order to prevent unauthorized access or disclosure, we have put in place physical, electronic and managerial procedures to safeguard and secure the personal information we collect online. Access to data will be provided to authorized individuals at the express consent of the Government of Bangladesh.

Where we have given you (or you have chosen) a password to access certain parts of the Services, you must keep this password confidential. You should not share this password with anyone. You are responsible for what happens with your log in credentials.

9. DISCLOSURES AND TRANSFER

Save as otherwise set out in Clause 2 with respect to information provided to persons carrying out medical and administrative interventions necessary in relation to providing you service, no personal information collected by the App will be disclosed or transferred to any third party.

10. GRIEVANCES

If you have any concerns or questions in relation to Privacy Policy, Security issues or intellectual property rights you may address them to the Grievance Redress focal point at CMED Health at info@cmedhealth.com.