3. What data is collected and processed?

We only collect personal data that is adequate, relevant and limited to what is strictly necessary with regard to the purposes for which it is processed. Depending on the purposes, data collection is carried out differently.

4. Processing of children’s data

Children’s data is collected only under the following conditions:

• The child is 16 years old or older and has provided their consent.
• The child is at least 13 years old, and consent from a parent or legal guardian has been obtained. Note that the specific age requirements may differ by jurisdiction. A parent or legal guardian may create an account on behalf of their child, assuming full responsibility for the account and its use.
• Within the context of a clinical study, consent from a parent or legal guardian has been obtained when the child is under 18 years old.

Parents or legal guardians have the right to review, request the deletion of, or refuse any further collection of their child's data. If data is inadvertently collected from a child without appropriate consent, immediate steps will be taken to delete the information upon notification via privacy@moveup.care.

5. Is your data disclosed or shared with third parties?

The data listed above is accessible to people who are members of our team, or intervening as collaborators, professional healthcare practitioners, and only to the strict extent necessary to our lawyers or any technical advisers, to banking or insurance organizations.

We are also likely to transmit your data:

• a) at the request of a legal, judicial or administrative authority or auxiliary of justice; or
• b) in good faith, considering that this action is required to comply with any current law or regulation.
• c) in order to protect and defend our rights or those of other users of our services.
• d) for the purposes of pharmacovigilance and materiovigilance to ensure patient safety and compliance with regulatory obligations.

We may also be required to leave access to certain data to our co-contracting parties, qualified as “subcontractors” within the meaning of the legislation, to the extent strictly necessary for the achievement of our purposes, such as the operation of applications or computerized management systems.

In all circumstances, we ensure the protection of your data by agreements ensuring confidentiality.

6. Do we transfer your data outside the European Union?

We do not make transfers outside the European Union. If applicable, data transfers to a country outside the Union will only be authorized if and only if:

• The European Commission has issued a decision granting an adequate level of protection equivalent to that provided for by European legislation.
• The transfer is covered by an adequate measure granting a level of protection equivalent to that provided for by European legislation, such as the Commission's Standard Clauses.
• Your consent.

7. How long is your data kept?

Your personal data that we process will be kept for:

• the duration of our contractual relationship.
• the time strictly necessary for the fulfilment of our legal and contractual obligations, as part of your registration/application.
• the time strictly necessary to protect the vital interests of you or any other person.

Retention periods

The personal data are kept for a limited time depending on the purpose and the legal obligations, and then securely deleted:

• Medical care customer: 7 years from 1 January of the year following the end of the financial year (accounting laws).
• Patient/customer: 30 years from our last action in your files.
• Identification/authentication of doctors and other care providers: no storage; deleted at the end of our contractual relation.
• Research/statistics/improving the application: 20 years after completion of our study and research for clinical trial.
• Communication: 2 years from your last contact with us.
• Pre-contractual relationships: 2 years after our last contact.
• Suppliers: 7 years from 1 January of the year following the end of the financial year (accounting laws).
• Litigation: in case of dispute, 7 years from notification of the decision (accounting laws).

8. How do we protect your privacy?

We strive to optimally protect your personal data against unauthorized use and leakages. To this end, we use physical, organizational, technological, administrative and appropriate measures such as, and not limited to:

• We use recognized security and encryption processes to ensure the security of the transmission and storage of your data to and from moveUP.
• We have organizational measures in place, such as restricting access to our computer systems in accordance with the strict needs of each member of staff.
• As soon as we can, your data will be pseudonymized or anonymized (depending on the purpose).
• We host your information on our servers which are protected by ad hoc security and certificates.
• We have an internal privacy policy and we conduct regular basic training to maintain data privacy awareness.

9. What are your rights and how to exercise them?

We attach a great deal of importance to the rights we have as individuals. We are at your service and invite you to contact our contact person at: privacy@moveup.care or via info@moveup.care or by post to our postal address.

We have also appointed a DPO, who is available to you at: sp@altalaw.be.

You can exercise the following rights:

• Right of access, information and rectification: to access and receive a copy of personal data.
• Right to restrict processing.
• Right to object: to object to processing. You can click “unsubscribe” in every e-mail you receive from us.
• Right to data portability.
• Right to erasure / right to be forgotten.
• Right to individual decision making: we combine automated processes with human intervention; no fully automated individual decision-making for the time being.
• Questions, comments, complaints, data leaks? Please report immediately via privacy@moveup.care.

At the latest one month after receipt of your request, we will inform you in writing of the action we have taken at your request. Depending on the difficulty of your request or the number of requests, this period may be extended by two months (we will inform you within one month of receiving your request).

Finally, you also have the right to lodge a complaint with the Data Protection Authority (DPA):

www.autoriteprotectiondonnees.be/
Rue de la Presse, 35 at 1000 Brussels
Phone: +32 (0) 2 274 48 00
Fax: +32 (0) 2 274 48 35
Email: contact@apd-gba.be

You can also lodge a complaint in the first instance court.

More info:
https://www.dataprotectionauthority.be/citizen/actions/lodge-a-complaint

10. Do we use cookies?

A cookie is a code in the form of a file stored on your computer. Cookies help us to improve our website, to facilitate your browsing and to analyze audiences.

To learn more about our Cookie Policy, please visit our website under the "Cookies Policy" tab.

11. What is the applicable law and the competent jurisdictions?

This Policy is governed by Belgian law. Any dispute relating to the interpretation or execution of this Policy will be subject to Belgian law and will fall under the exclusive jurisdiction of the courts of the judicial district of Brussels.

12. Be mindful to the update of this policy!

This Policy can be updated at any time without notice of modification. We advise you and invite you to consult it regularly.