Skip to main content

Home

Bridge the gapp

/

Privacy Policy

Last updated: July 19, 2023

This Privacy Policy describes Our policies and procedures on the collection, use and disclosure of your information when you use the service and tells you about your privacy rights and how the law protects you.
We use your personal data to provide and improve the service. By using the service, you agree to the collection and use of information in accordance with this Privacy Policy.
This Data Privacy Policy is published in order to comply with the provisions of the Personal Information Protection and Electronic Documents Act (PIPEDA), as well as any jurisdictional and provincial laws that are applicable to our processing of your personally identifiable information (PII).

ORCHA also publishes this policy:

  • to ensure all ORCHA data capture, data management and data utilization processes are transparent to our end users.

  • to clearly explain what data we collect

  • to explain how ORCHA uses any personal information that our end users supply to us.

Interpretation and Definitions

Interpretation

The words of which the initial letter is capitalized have meanings defined under the following conditions. The following definitions shall have the same meaning regardless of whether they appear in singular or in plural.

Definitions

For the purposes of this Privacy Policy:

  • Account means a unique account created for You to access our Service or parts of our Service.

  • Affiliate means an entity that controls, is controlled by or is under common control with a party, where 'control' means ownership of 50% or more of the shares, equity interest or other securities entitled to vote for election of directors or other managing authority.

  • Company (referred to as either 'the Company', 'We', 'Us' or 'Our' in this Agreement) refers to ORCHA Health Ltd.

  • Cookies are small files that are placed on Your computer, mobile device or any other device by a website, containing the details of Your browsing history on that website among its many uses.

  • Country refers to: Canada.

  • Device means any device that can access the Service such as a computer, a cell phone or a digital tablet.

  • Personal Data is any information that relates to an identified or identifiable individual.

  • Service refers to the Website.

  • Service Provider means any natural or legal person who processes the data on behalf of the Company. It refers to third-party companies or individuals employed by the company to facilitate the service, to provide the service on behalf of the company, to perform services related to the service or to assist the company in analyzing how the service is used.

  • Usage Data refers to data collected automatically, either generated by the use of the Service or from the Service infrastructure itself (for example, the duration of a page visit).

  • Website refers to ORCHA, accessible from orchahealth.com

  • You means the individual accessing or using the service, or the company, or other legal entity on behalf of which such individual is accessing or using the Service, as applicable.

Collecting and Using Your Personal Data

How We collect information

ORCHA collects personal information about you when:

  • you or your organization registers your professional details with us to become a Pro User for an ORCHA site.

  • you undertake actions on the ORCHA site such as:

    • Recommend an App to another user, if that functionality is available to you.

    • Visit web pages on an ORCHA site.

    • Complete specific actions on an ORCHA web page – e.g., Click on the 'Download an App' button.

    • Participate and complete modules in the ORCHA Digital Health Academy

  • you complete an ORCHA survey.

  • you take part in an ORCHA event or competition.

  • you provide us with personal information in any other way.

  • you enquire about the fundraising campaigns that we run

All these actions are required to enable ORCHA to deliver its services as a Data Processor and we only capture the minimum number of data items required for the delivery of those services.
All data that is captured through your interactions with ORCHA is stored securely in protected databases and only accessible to accredited administrative users with specific access permissions.
Data transferred between ORCHA webpages and the data stores we utilize is fully encrypted in transit, in line with best practice encryption methodologies (certified 256bit encryption) to minimize the risk of that data being intercepted or breached. ORCHA use Transport Layer Security (TLS) 1.2 to transmit data securely when the ORCHA systems are accessed via a browser.

Types of Data Collected

Personal Data

While using Our Service, we may ask You to provide Us with certain personally identifiable information that can be used to contact or identify You. Personally identifiable information may include, but is not limited to:

  • Your name

  • Your address

  • Email address

  • First name and last name

  • Phone number

  • Non-mandated additional information volunteered by you (e.g., age)

  • The pages you view on ORCHA websites.

  • The Apps you recommend to others.

  • The Apps you download via the ORCHA sites.

  • The address, name, and job role of relevant Healthcare Professional (if applicable)

ORCHA also uses Google Analytics which collects the following information from all users of the platform, registered and unregistered:

  • Internet Protocol (IP) address

Google Analytics service allows us to maintain a strong understanding of ORCHA platform utilization to ensure the platform is continually improved for our platform users. The IP address is held separately from all data captured by ORCHA directly and cannot be used to identify an individual directly.
For more information on the Privacy Controls utilized in Google Analytics please visit:

https://support.google.com/analytics/answer/6004245?hl=en&ref_topic=2919631

ORCHA uses Hotjar in order to better understand our users’ needs and to optimize this service and experience. Hotjar is a technology service that helps us better understand our users’ experience (e.g., how much time they spend on which pages, which links they choose to click, what users do and don’t like, etc.) and this enables us to build and maintain our service with user feedback. Hotjar uses cookies and other technologies to collect data on our users’ behavior and their devices.

This includes a:

  • device's IP address (processed during your session and stored in a de-identified form),

  • device screen size, device type (unique device identifiers),

  • browser information,

  • geographic location (country only), and the preferred language used to display our website.

Hotjar stores this information on our behalf in a pseudonymized user profile. Hotjar is contractually forbidden to sell any of the data collected on our behalf.

For further details, please see the ‘about Hotjar’ section of Hotjar’s support site.

ORCHA also collects the following usage data relating to the ORCHA Digital Health Academy (accessible to all Pro Users) internally:

  • Academy courses accessed.

  • Progress against the academy courses accessed.

How we get this information and why we have it

We collect this information through your interaction with the ORCHA platform and through your direct interactions with us as a company. We collect it to ensure we can deliver the full functionality of the ORCHA platform to you, and any additional ORCHA services you request directly from us. We also utilize the data to understand how users interact with the ORCHA platform so that we can continually adapt and improve the ORCHA platform for our users.
ORCHA will only capture the minimum number of data items necessary to ensure the fulfillment of required ORCHA services.

How we use your information

ORCHA uses the information that you give to us:

  • to send you information, products or services that you have consented to receive.

  • to improve the information, products and services ORCHA offers to its users. (This includes improving our capability to match Health Apps specific to your health need/age/preferences and general improvement of ORCHA website and review functionality and presentation)

  • to contact you about events, fundraising, campaigning and our other work, where you have consented to receiving marketing information.

  • to develop aggregated reports and analysis, using anonymized data, to support research into the broader ongoing development of the Health App market and the utilization of Health Apps within a defined Health Economy

  • to communicate with you to support activation, training delivery and uptake in use of Pro Accounts (this data use applies to Pro Account users only).

ORCHA may link data captured from different ORCHA services (e.g., The ORCHA Digital Health Academy), at a personal level, in order to improve our understanding of service utilization and to support analyses on site utilization and activity, but ORCHA will never publish, share or sell personally identifiable data without explicit, and informed, consent being received from all parties whose data is being used for those purposes.

Transfer of Your Personal Data

Your information, including Personal Data, is processed at the Company's operating offices and in any other places where the parties involved in the processing are located. It means that this information may be transferred to — and maintained on — computers located outside of Your state, province, country or other governmental jurisdiction where the data protection laws may differ than those from Your jurisdiction.
Your consent to this Privacy Policy followed by Your submission of such information represents Your agreement to that transfer.
The Company will take all steps reasonably necessary to ensure that Your data is treated securely and in accordance with this Privacy Policy and no transfer of Your Personal Data will take place to an organization or a country unless there are adequate controls in place including the security of Your data and other personal information.

How do we store and manage your data?

The Azure ORCHA solution is hosted on Azure and utilises a Hub and Spoke networking model. Any electronic protected health information (ePHI) sits in the geographic jurisdiction of the client so local governance laws can be adhered to.. For example, a Canadian clients ePHI data would be hosted with Azure in Canada in a way that adheres to local provincial compliance laws. ePHI is stored in these local Spokes whereas all other system data is stored within the central Hub hosted in Azure UK South. All data is encrypted at rest.
All Azure-to-Azure communication within the ORCHA platform is done through the Azure backbone. On top of that, environments are hosted within Virtual Networks. There is a single point of access for all data and that is through Azure Front Door and then through a Firewall and then into the Hub. Once the Hub is accessed then data can be requested from any of the Spokes. All data that is passed out of the system goes back though the Firewall and then through Azure Front Door.
Access to the Production environment is through a Bastion host (Jump Box) and users can Remote Desktop to this machine. To access this the user needs to have an Azure Active Directory account and needs to have the correct permissions assigned. Production data is not used for reporting purposes.

How do we protect personal information?

ORCHA implements a range of measures to ensure that any personal information that you provide us with is kept secure, accurate and up to date.
ORCHA's protective measures include:

  • regular reviews of data capture processes to ensure only data that is necessary to support the delivery of ORCHA services is captured.

  • transparent, informative opt-in Consent capture mechanisms to ensure that all ORCHA service users understand why ORCHA collects their data and how ORCHA manages that data.

  • ORCHA provides the functionality for users to retract their consent should their preferences change. This functionality is available in the ‘My Account: Your rights under GDPR’ section on all ORCHA platforms.

  • Users who choose not to provide any personally identifiable data, can continue to use the ORCHA platforms as normal, but the full functionality of the ORCHA platform will not be available to those users.

  • Strong encryption of all data in transit between the ORCHA sites/Apps to our secure data storage facilities using certified 256 bit encryption.

  • ORCHA databases are secured within a hosted via Microsoft Azure.

  • Access to data collected through ORCHA interactions with end users of our services, is limited to only those ORCHA Data Administrators with appropriate permissions.

  • Critical system components are backed up across multiple, isolated locations and the system continuously monitors service usage to deploy infrastructure to support availability commitments and requirements.

  • ORCHA keeps personally identifiable data for a period of 2 years following the closure of an account for legal and audit purposes. After this period all personally identifiable data items are destroyed in line with best practice data destruction standards.

Third parties

ORCHA will not pass your personal details to other people, or organizations, without first obtaining your consent.
ORCHA reserves the right to share your information with other companies that we own, or other companies that help us provide any of our services. There may be rare occasions where information is gathered through the day-to-day collection of ORCHA data, where the data identifies a clear need to safeguard the welfare of the individual and/or his/her family and, on those occasions, it may be necessary to contact relevant authorities to address this. ORCHA will only undertake these actions in line with appropriate legal guidelines and using formal, recognized, and auditable processes.

Your consent

By providing ORCHA with personal information, the end user is agreeing to ORCHA's use of that information as stated in this Privacy Policy.
Your consent to utilize ORCHA services is contained within the ORCHA registration process and will clearly inform the user at the point of registration why the data we are requesting is necessary and how that data will be used by ORCHA.
The ORCHA consent process requires all end users to positively opt-in to a range ORCHA services, with information provided to explain each option prior to sign up.
Consent preferences can be changed at any time. The functionality to withdraw Consent is provided within the ‘My Account’ section on the ORCHA platform.

Retention of Your Personal Data

The Company will retain Your Personal Data only for as long as is necessary for the purposes set out in this Privacy Policy. We will retain and use Your Personal Data to the extent necessary to comply with our legal obligations (for example, if we are required to retain your data to comply with applicable laws), resolve disputes, and enforce our legal agreements and policies.
The Company will also retain Usage Data for internal analysis purposes. Usage Data is collected and stored anonymously and is generally retained indefinitely when stored in such a way. This data is used to strengthen the security or to improve the functionality of Our Service.

Delete Your Personal Data

You have the right to delete or request that We assist in deleting the Personal Data that We have collected about You.
Our Service may give You the ability to delete certain information about You from within the Service.
You may update, amend, or delete Your information at any time by signing into Your Account, if you have one, and visiting the account settings section that allows you to manage Your personal information. You may also contact us to request access to, correct, or delete any personal information that You have provided to Us.
Please note, however, that We may need to retain certain information when we have a legal obligation or lawful basis to do so.

Disclosure of Your Personal Data

Business Transactions

If the company is involved in a merger, acquisition or asset sale, Your personal data may be transferred. We will provide notice before your personal data is transferred and becomes subject to a different Privacy Policy.

Law enforcement

Under certain circumstances, the company may be required to disclose your personal data if required to do so by law or in response to valid requests by public authorities (e.g., a court or a government agency).

Other legal requirements

The Company may disclose your personal data in the good faith belief that such action is necessary to:

  • Comply with a legal obligation.

  • Protect and defend the rights or property of the company.

  • Prevent or investigate possible wrongdoing in connection with the service.

  • Protect the personal safety of users of the service or the public.

  • Protect against legal liability.

Your Rights

Depending on the jurisdiction in which you reside, there may be particular laws in place that entitle you to certain rights, such as “individual access”. This principle allows You to request information about whether or what information We hold about you. When applicable, we must also allow consumers to access and modify their personal information.
You are not required to pay any charge for exercising your rights. If you make a request, ORCHA will respond to you within one month. However, we aim to provide a response to all Data Rights Requests within 24 hours, with full completion of related actions within seven working days.
Please contact us at dpo@orchahealth.com if you wish to request any changes to the data ORCHA holds about you or to withdraw your consent. Please state in the heading of your email which right or rights you wish to exercise.

Children's Privacy

Our Service does not address anyone under the age of 13. We do not knowingly collect personally identifiable information from anyone under the age of 13. If You are a parent or guardian and You are aware that Your child has provided Us with Personal Data, please contact Us. If We become aware that We have collected Personal Data from anyone under the age of 13 without verification of parental consent, we take steps to remove that information from Our servers.
If We need to rely on consent as a legal basis for processing Your information and Your country requires consent from a parent, we may require Your parent's consent before We collect and use that information.

Data Sovereignty

As an organization experiencing ongoing growth and development, ORCHA Health will be conscientious in the way its collects, stores, uses and shares data, as well as protecting data, preserving its security and managing information consistent with jurisdictional laws and standards.

While ORCHA Health does not currently process First Nations data, we will be conscientious in its evolving developmental and ongoing policy work in this area of First Nations data sovereignty and First Nations data governance, respecting the data and research principles of OCAP.

This conscientiousness is explicitly stated to prevent both historic and continued practices of perpetuation of First Nations data used to gather, analyze and disseminate information on First Nations communities as a means of systemic oppression, and as a means of creating barriers and unequal power relations; explicit conscientiousness is also needed to prevent the use, collection and interpretation of First Nations data through a statistical lens which reflects disadvantage and negative stereotyping; and, lastly, conscientiousness is required to prevent data on First Nations communities collected by others which has little or benefit to those communities.

Overall, ORCHA Health’s data sovereignty and data governance principles will ensure that its data is safeguarded as First Nations intellectual property and is of great value and meaning to its members and First Nations communities. From a practical perspective, such data and information of great value and meaning is effectively and positively used to advise and influence policy and institutional decision-making.

Alongside our decision to be conscientious in our possible future involvement of processing First Nations data, ORCHA Health will take an equally conscientious approach to the processing of any other race-based data. Our intended approach to achieving this is to follow the standards set by the EGAP (Engagement, Governance, Access and Protection) Framework and apply the same standards across all ethnic groups that we would collect data on, if required under a project that we support another organization with.

Links to Other Websites

Our service may contain links to other websites that are not operated by us. If You click on a third-party link, you will be directed to that third party's site. We strongly advise you to review the Privacy Policy of every site You visit.
We have no control over and assume no responsibility for the content, privacy policies or practices of any third-party sites or services.

Changes

If your personal details change, please help the ORCHA team to keep those details up to date by telling us about any changes.

If you want to see what information we have about you, or need to tell us about any changes to the information that you have given to us, please contact:

Data Protection Officer,
ORCHA Healthcare Ltd.
V2
Keckwick Lane,
Daresbury
WA4 4AB
 Email: dpo@orchahealth.com

We may update Our Privacy Policy from time to time. We will notify You of any changes by posting the new Privacy Policy on this page.
We will let You know via email and/or a prominent notice on Our Service, prior to the change becoming effective and update the 'Last updated' date at the top of this Privacy Policy.
You are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page.

How to complain

In the first instance, if you have any complaints or concerns regarding potential data breaches, our privacy practices, or misuse of your data by Us, please contact the ORCHA data protection officer (DPO) at dpo@orchahealth.com
If you remain dissatisfied you can complain to your local data protection authority, if you are unhappy with how we have used your data and/or handled a suspected breach.

Contact Us

If you have any questions about this Privacy Policy, you can contact us: