Privacy Policy

patientMpower designs and develops services and applications for patients with chronic diseases, such as lung disease, kidney disease and cardiovascular disease. We empower users to manage their health at home and improve their health outcomes. Patient’s health data can be seen immediately by their care team in a secure patient data portal. Healthcare staff can then make informed decisions about the ongoing care needs of patients being monitored.

We are a company incorporated in Ireland under registration number 563516.

You can contact us at our main business address: patientMpower, 10/13 Thomas Street, The Digital Hub, Dublin 8, D08 PX8H, Ireland, or via www.patientmpower.com.

Our Data Protection Officer can be contacted via dataprotection@patientmpower.com, or by post at the address above. Our Data Protection Officer is Oisin Hayes.

We believe that making data more easily available to patients will improve healthcare, but we are also aware that data needs to be handled securely and transparently. We believe you should own your own data and should have the choice about who has access to your data or who you consent to view the data. patientMpower respects your right to data protection and to privacy. This Data Protection Notice explains how we collect, transfer, store, and use your data.

As part of our ethos of continuous improvement, this Data Protection Notice and any associated policies or procedures may be changed in the future. If we make changes we will provide notice of any proposed changes at least thirty (30) days before they come into effect. You are free to stop using our apps and services at any time but we would recommend that any decision be taken in consultation with your healthcare provider.

patientMpower provides smartphone applications and associated equipment and clinical patient management and reporting portals that enable clinicians to provide appropriate care through telemedicine and allow patients to manage and monitor their condition themselves without losing the necessary contact with and support of their healthcare providers.

We use your health and medical information to provide you with a healthcare service in the form of a diary for personal use or sharing your data with your healthcare provider for remote monitoring. We only capture data that is relevant for providing better delivery of care, improving our apps and services, and assessing remote patient monitoring.

patientMpower acts as a Data Processor on behalf of healthcare providers in the provision of our services and applications.

We act as a Data Controller for data logged by you in a personal health diary if you are using our services or applications in that way.

If you have consented to allowing your data to be included in research studies, we act as a Data Controller for that data for the purposes of creating anonymised data sets to be used in research.

We also act as a Data Controller in the context of processing of data for the purposes of product and service improvement and product research and development. However, data used for these purposes is de-identified and anonymised other than in exceptional circumstances.

When you use our services and apps, we collect information about your health. This information can be manually entered by you or be collected automatically from your smartphone and/or connected health device. Other health information may come from third parties, such as your healthcare provider or other health partners.

If you choose to use a Google account or other social media account to complete the sign-up process for one of our applications, we are authorised to collect, store, and use any information that you have agreed to let these sites or services share with us. This may include your name, email address, profile picture, or other details.

When you use our services or apps, you may have the option to link other third-party services with your account. Examples of these services may include Apple Health, Fitbit, etc. If you choose to do this, you are authorising patientMpower to collect, store, and use information that you agreed these sites may share with us through their API.

Please note that using third party services to facilitate login or to capture or provide data to the patientMpower application can identify to those services that you are a user of a telemedicine application. You should check the data protection or privacy terms of the service you are using to find out what that data may be used for by that third party service.

Summary:

We obtain your personal data in one or more of the following ways:

• You directly provide it to us by manually inputting it into the app (example: your name, survey responses, health result data, demographic data, information on health condition, medications, support requests or correspondence)
• You authorise a third party to provide it to us (example: your healthcare provider sends medical results to you via the patientMpower application, you register using your social media account, or you connect to other apps or services such as Apple Health Kit)
• We automatically record it from your device, depending on the enabled features (example: data collected on smartphone or via a connected sensor, step counts from accelerometers, location information)

The specific types of personal data we process about you may vary depending on the specific patientMpower app you are using or the specifics of the treatment regime being applied. Examples or descriptions of categories of data provided here are not exhaustive and are for information purposes. Supplemental information will be provided to users for specific application contexts where necessary.

Permissions Requested by the patientMpower App

Depending on the version of the patientMpower app you are using different permissions may be asked for to access features or functionality on your device or from 3rd party services.

Personal Information (PII) and Personal Health Information (PHI) (for United States)

patientMpower processes Personal Information (PI) and Personal Health Information (PHI) as a necessary part of the operation of our services to support the delivery of patient care and, subject to appropriate consents, to support research activities by approved researchers.

patientMpower makes use of several different categories of data processors to help us deliver our services.

patientMpower may provide personal data to the following categories of recipient:

• To healthcare providers, through a secure monitoring portal or through integration with their healthcare record systems. Your authorisation will be sought before any transfer of data to another platform.
• To law enforcement agencies or regulatory authorities on receipt of a valid court order or where expressly required under legislation and only to the extent required by law.
• To third parties where necessary to comply with a court order
• In the event of a corporate sale, merger, reorganisation, sale of assets, dissolution, or other business-related event, your information may be transferred as part of the assets of patientMpower.

De-identified and anonymised data is provided to approved clinical research partners for the purposes of conducting research in respect of treatment and management of conditions. These studies are carried out under appropriate research conditions and are subject to independent ethics approval through our research partners.

patientMpower retains identifiable data for the duration of your treatment or use of the application plus any retention period that may be defined by:

• Data retention requirements for clinical data as may be specified by healthcare providers
• Legal requirements set out in legislation or regulatory guidance in jurisdictions in which our services are provided
• Periods that are reasonably necessary for business and legal purposes.

We will also keep data which cannot directly or indirectly identify living individuals for analytics and research purposes to help improve our products and services.

We place great importance on the security of all personal data associated with our users. We have security measures in place to attempt to protect against the loss, misuse and alteration of personal information under our control.

patientMpower is designed with stringent security protocols. It uses state-of-the art electronic surveillance and multi-factor access control systems. All data transport between your app and our servers is encrypted. Data is encrypted in transit using HTTPS and TLSv.1.2, and encrypted at rest on AWS using AES 256 encryption.

We use a risk management process based on a Health Insurance Portability and Accountability Act (HIPAA) template. It allows us to conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information held by patientMpower, and also implement security measures sufficient to reduce risks and vulnerabilities to a reasonable and appropriate level to comply with HIPAA standards.

Periodic reviews of our security standards are carried out and our software development process has a checkpoint to identify new risks when we define / develop new features.

However, with any electronic transmission and storage of data comes risks and we cannot guarantee that our databases, or those of our third-party affiliates, will be 100% secure. There is also a risk of data being intercepted while being transferred over the internet. 

In the event of a breach of data security, patientMpower will:

• Immediately inform any relevant health care provider for whom we are acting as a Data Processor in the delivery of care and engage with their Data Security Incident response processes as required.
• Where we are acting as a Data Controller, we will notify without undue delay the relevant Supervisory Authority where we identify that there is a risk to the fundamental rights and freedoms of people using our applications or services
• Where we are acting as a Data Controller and we identify a high risk to your rights and freedoms is identified we will notify you of the incident without undue delay.

The operation of the patientMpower applications and services does require the processing of data for profiling and does make use of automated decision making to identify usage patterns in the app and ensure notifications are sent to users to remind them to record health data (e.g. take blood pressure) or to support prompts and alerts to help users use the application or associated measurement devices or medical equipment correctly (for example: alerting users if their spirometry test did not meet the required quality).

No decisions are taken based solely on automated decision making which would have a legal or equally significant impact on a user as these applications and services are used as part of a clinical treatment regime overseen by healthcare professionals.

Where patientMpower is acting as a Data Controller, you have rights under EU Data Protection law.  These rights are:

• A right of access which allows you to request a copy of your data in an intelligible form (Article 15 GDPR)
• A right of rectification which allows you to request a correction of errors or inaccuracies in the data that we hold relating to you (Article 16 GDPR)
• A right to object to processing and to “opt-out” of having your data processed by us on the basis of our legitimate interests or a public interest basis unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms. (Article 21 GDPR)
• A right to erasure in certain specified circumstances. This right does not apply where we are processing data for compliance with a legal obligation, for reasons of public interest in relation to public health, for archiving purposes for historical or scientific research, or where necessary to establish or defend legal claims (Article 17)
• A right to restrict processing in certain circumstances (Article 18)

To do any of these things, please email us at dataprotection@patientmpower.com. We’ll ask you for proof of identity. Data protection laws give us one month to get back to you. Under GDPR individuals also have rights to seek compensation for infringement of their data protection rights under the legislation.

You have the right to file a complaint to the Irish Data Protection Commission. 

Their contact information can be found online at this link: https://dataprotection.ie/en/contact/how-contact-us

patientMpower complies with HIPAA through our application of an appropriate risk management framework in line with our business associate agreements entered into with clients who are US Healthcare providers and covered entities under HIPAA.

For the purposes of the United States COPPA rule, parental consent is required for the use of our applications or services by any person under the age of 13. We do not knowingly collect data from children under the age of 13.