Use of our mobile app
I. Information on the collection of personal data
(1) We, Innoplexus AG ) (“Innoplexus“), provide you with a mobile app (“CURIA” or the “Service“) that you can download to your mobile device. We respect your privacy and are committed to protect your personal data which you share with us. In the following, we provide information about the collection of personal data when using CURIA, manner in which we may use such personal data and your rights with respect to personal data you provide to us. Personal data includes all data that can be personally related to you, e.g. name, address, email addresses, user behavior, etc.
(2) The person responsible is
Frankfurter Str. 27, 65760 Eschborn, Germany
email@example.com (see our imprint: www.curia.app/impressum).
Innoplexus is a German company.
The company data protection officer of Innoplexus can be contacted at the above address, at Datenschutzabteilung, or at firstname.lastname@example.org.
(3) When you contact us via email or a contact form, we will store your email address and, if you have provided it, your name and telephone number to answer your questions. We delete the data arising in this connection after storage is no longer required or – in the case of legal storage obligations – restrict processing.
(4) If we use contracted service providers for individual functions of our offer or wish to use your data for advertising purposes, we will inform you in detail about the respective processes below. We will also state the specified criteria for the storage period.
(5) IMPORTANT NOTICE:
You are under no legal duty to provide us with any personal data. However, we do need your personal data in order to provide you with the Service. You hereby acknowledge and agree that you are providing us with such information at your own free will.
II. The purpose for which we collect your personal data
III. Legal basis for collecting and using personal data
We collect, process and use your personal data based at least on one of the following legal bases:
IV. Processing of personal data when using CURIA and which data we may collect on users
By uninstalling, the active processing of your personal data is stopped. 30 months from the date of uninstalling, the data will be deleted due to the discontinuation of purpose, unless we are subject to any statutory retention obligations. We accept the loss of purpose after such period because we assume that it is no longer likely that you will use our services again after such period. However, in order to give you the opportunity to restore your profile after a shorter period of time, e.g. because you deleted the app earlier for lack of necessity, we temporarily store the data for you.
However, if you wish to revoke your consent and not just temporarily suspend its use, you can do so by clicking the “Delete all my personal data” button.
§1 When using CURIA, we collect the following log file data:
– IP address, also in the API logs
– Date and time of the request
– Content of the request (concrete page, concrete API endpoint)
– Access Status/HTTP Status Code
– Amount of data transferred in each case
– End device from which the request comes
– User Agent
– Operating system and its interface
– Language and version of the User Agent.
On the one hand, this data is mandatory for us from a technical point of view in order to offer the various functions of CURIA as well as to ensure the stability and security of CURIA and, on the other hand, to enable a comfortable use of the Service and functions.
IP addresses in log files are deleted after 14 days.
§2 Furthermore, when CURIA is started for the first time, we assign a unique installation ID for each installation, which is stored on an Innoplexus server. It contains no personal data. If you delete CURIA and then reinstall it, a new installation ID will be generated. This will be assigned so that a connection to the Innoplexus server can be established when starting CURIA on the mobile device to check if the version of CURIA you are using is still up to date. CURIA can be updated to implement new features or to ensure data security, fix bugs, etc.
§3 You must register with your first and last name, e-mail address and telephone number in order to take advantage of CURIA’s free services. This creates a contract of use between Innoplexus and you and you will receive your own user account. We use this personal data for the execution of this contract. The data you provide will be transferred to the Google Cloud and stored on a server in Germany. The Google Cloud is operated by Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043 USA. We have concluded so-called standard contractual clauses with Google, which guarantee an appropriate level of data protection.
Alternatively, you can log in using your Google user account. For this we collect the following personal data:
– First and Last Name
– E-mail address
You can delete your account at any time by clicking the “Delete my personal data” button within CURIA. The personal data processed by us will be deleted or blocked or restricted in their processing. The data stored by us will be deleted as soon as the purpose of storage no longer applies and the deletion is not contrary to any legal storage or other obligations.
§4 If you would like to receive information about possible treatment options, physicians and clinical studies, you can fill out the questionnaire provided by us with questions about your clinical picture. Cancer-specific parameters will be asked, such as information on genetic mutations, the status of the respective cancer, etc. The information you provide is voluntary and serves the sole purpose of enabling us to provide you with information.
You are free to revoke your consent at any time with effect for the future without giving reasons. This does not affect the legality of the processing carried out up to that point.
You also have the option of registering for participation in clinical studies. To do so, you must provide the following information: Information about the study you wish to register for, your location, contact information (telephone number or e-mail address), information about your medical inclusion and exclusion criteria. The provision of this personal data is voluntary. The purpose of the processing is to carry out the selection procedure. You are free at any time to revoke your consent with effect for the future without giving reasons by selecting the option “Delete all my personal data” in the app. This gives you the option to delete all personal data. After clicking on the “Delete all my personal data” option, you will receive an automated email confirming the deletion of your data. This does not affect the lawfulness of the processing that took place until the revocation.
The completed questionnaires and applications for participation in clinical trials are transferred to the Google Cloud and stored on a server in Germany. The Google Cloud is operated by Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043 USA. We have concluded so-called standard contractual clauses with Google, which guarantee an appropriate level of data protection. If you have met all eligibility criteria for the clinical trial request, the personal data you have provided will be transferred to the internal Innoplexus clinical trial dashboard. This data can be accessed by the CURIA team, which is partly based in India and is part of Innoplexus Pune. Here, an appropriate level of data protection is ensured through the conclusion of standard contractual clauses.
§5 We use Google Analytics and Google Firebase, both services provided by Google Inc, 1600 Amphitheatre Parkway, Mountain View, CA 94043 USA, to
Your IP address will be processed. We use the anonymization function of Google, whereby the IP address is shortened in the EU/EEA for anonymization purposes and is transmitted in shortened and anonymized form to Google servers in the USA. We use the anonymized reports on the general use of CURIA created by Google and transmitted to us in order to continuously improve our service and increase the user-friendliness of CURIA. The reports we receive contain no personal data.
The data is processed in the USA, for which we have so-called standard contractual clauses with Google that guarantee an appropriate level of data protection.
The data will be deleted when they are no longer necessary for the purpose of their collection because the option to collect and further process information on diagnosis and usage behavior in CURIA has been deactivated.
You are free to revoke your consent at any time with effect for the future without stating reasons. This does not affect the legality of the processing that has taken place up to that point.
V. Processing of personal data and which data we may collect when using the Cancer Twin feature
A Cancer Twin is a patient in the Curia community whose cancer diagnosis is similar to yours. Cancer Twins can use a private chat to share experiences. The chat is based on Ethereum blockchain technology. The aim of the new feature is to bring cancer patients together.
§1 As part of a matching process, you as a user will be matched together with up to 3 other cancer patients, Cancer Twins, who have activated this feature and have a similar profile. In order to find a matching Cancer Twin, the following parameters are compared, which we collect from you to carry out the matching process:
– Cancer indication
– Hormone receptors
– Genetic markers
– Other health data, depending on cancer type
Naturally, a CURIA user to whom your profile is proposed as a potential Cancer Twin can infer from such proposal that the parameters you provided correspond to the parameters provided by such user.
The purpose of this feature is to bring together cancer patients and promote the exchange of experiences and information between patients who have a similar cancer diagnosis. You are free to revoke your consent at any time without giving reasons with effect for the future. This does not affect the legality of the processing carried out up to that point.
If the last login date is more than 6 months ago, the corresponding profile is automatically removed from the database and can no longer be matched with new Cancer Twins.
§2 Cancer Twins can exchange information in a chat integrated in CURIA. Patients must register for the feature and select a nickname before being matched with their Cancer Twin(s). This nickname can be edited in the settings. When users exchange messages via the built-in chat, the end-to-end encrypted messages are stored on a public Ethereum blockchain.
For this purpose, Innoplexus has provided a node that takes on the function of an intermediary to forward the chat message to the Ethereum blockchain. Before a message is transmitted and stored on the blockchain, it is fully encrypted locally on the patient’s mobile device using end-to-end encryption. The private key needed to encrypt the message is stored on your physical device the whole time and is not shared with Innoplexus or other users. Only when the encrypted message is received by the Cancer Twin, this message is decrypted with a corresponding key on the mobile device of the Cancer Twin who is to receive the message.
The purpose of this chat function is to enable the exchange of information and experiences in a simple way and without big hurdles, offering at the same time a high level of security. You are free to revoke your consent at any time without giving reasons with effect for the future. This does not affect the legality of the processing carried out up to that point.
In this case, the chat associated with your profile will be deleted from your device. In such case, the private key is lost and no one can decrypt the data, not even CURIA or Innoplexus. The nickname and chat content on the device of the Cancer Twin with whom messages were exchanged also disappear. Besides this, your profile will be automatically removed from the Cancer Twin database if the last login date is more than 6 months ago.
The server location cannot generally be assigned to a specific country due to the blockchain infrastructure (Public Ethereum blockchain), but by encrypting the chat content using a public key encryption method, the data is highly pseudonymised for everyone else, so that a data transfer to a third country can be considered “safe”.
Hashed metadata is not stored on the Ethereum blockchain.
VI. Where do we store personal data?
Other than where otherwise described above, the data you provide will be transferred to Google Cloud and stored on a server in Germany. The Google Cloud is operated by Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043 USA. We have concluded so-called standard contractual clauses with Google, which guarantee an appropriate level of data protection.
For additional information with respect to Google Cloud privacy practices you may visit the following link:
VII. Sharing data with third parties
We will not share any personal data we collect on you with any third party, except in the following cases:
VIII. Transfer of your personal data – third party software/service
We may transfer and share your personal data with our selected partners and service providers who assist us with various aspects of our operation and business. These include:
-Storage and processing services (such as Google LLC),
-Web and app analytics services (such as Google LLC)
These companies are authorized to use your personal data only as necessary to provide these services to us and not for their own promotional purposes. You hereby acknowledge and consent to such sharing and transfer of your data, including transferring outside of Israel. We do not sell your personal data to third parties.
IX. Access to personal data and modification of personal data
If you wish, we can provide you all your personal data which you provided to us. To do so, please contact us at email@example.com.
If for any reason you wish to update, modify or revise your personal data that is stored with us and identifies you, you may do so on the Service by editing your information on your account.
We implement measures to secure the Service and your personal data. For example, personal data is hosted on Google Cloud servers, which provide advanced security features. However, such measures do not provide absolute information security and we do not and cannot guarantee that unauthorized access will never occur.
We recommend using the strongest password combination available on your mobile device to protect unauthorized access to your mobile device.
XI. Direct Marketing
You acknowledge and agree that we may use your contact details for the purpose of informing you regarding our products and services and for sending you other marketing material, such as for example relevant medical data, updates and news, including as part of the Service as well as via the e-mail address or phone number you have provided.
We may also contact you as part of the Service for the purpose of informing you of treatments or clinical trials that might be relevant to you.
You may withdraw your consent by notifying us to our following email address: firstname.lastname@example.org.
We may also contact you with information regarding our Service. For example, we may notify you (through any of the means available to us) of changes or updates to our Service, maintenance, etc. You cannot opt-out of receive such service notifications.
To use our Service, you must be over 18 years old. We do not knowingly collect personal data from persons under the age of 18, unless it was provided by the user’s family member who is over the age of 18 and has the right to provide personal data on the minor’s behalf. We reserve the right to request proof of age at any stage so that we can verify that minors under 18 years old are not using the Service. In the event that we become aware of a person under 18 years old using the Service, we reserve the right to block such user’s access to the Service.
XIV. Questions, comments and complaints
Should you have any questions, comments or complaints, or if you believe your personal data as been misused, please contact us at email@example.com. We will do our best to resolve your issue in a timely manner. We may ask you to provide us certain personal information in order for us to identify you.
Last updated: 4th Jan 2022