Effective as of June 23, 2020.
We provide important information for individuals located in the European Union, European Economic Area, and United Kingdom (collectively, “Europe” or “European”) below.
PathCheck is a technology business operating for the purposes of providing contact tracing and exposure notification technology to government bodies and other organizations (each a “Partner”). PathCheck has and continues to develop software that is intended for use by Partners to facilitate contact tracing and exposure notification, including in connection with their analysis and response to the COVID-19 virus. Similarly, PathCheck continues to develop the PathCheck GPS, which helps individuals more easily participate in contact tracing efforts by those that are using PathCheck’s software.
How the PathCheck GPS Works
The PathCheck GPS enables a Partner to manage COVID-19 related information that the PathCheck GPS users provide. The PathCheck GPS provides Partners with the following capabilities to help respond to a disease occurrence including epidemics and pandemics:
- Information Intelligence
- The PathCheck GPS enables Partners to collect personal information in a digital format to enable them to analyze and understand developments in the spread of the COVID-19 virus and other diseases.
- The PathCheck GPS enables, through in-band communications (meaning through the PathCheck GPS), the transfer of reliable personal information (including location data) between its users and relevant Partners. The PathCheck GPS’s location data functionality may allow the relevant Partner to transmit automatic exposure notification to the user.
- The PathCheck GPS enables Partners to provide citizens with public health data.
- The PathCheck GPS enables end users to share personal information with Partners to help them respond to disease outbreaks.
Personal Information We Collect
Information you provide to us. Personal information you provide to us through the Service or otherwise may include:
- Contact information, such as first and last name, phone number, addresses, and work location.
- Feedback or correspondence, such as information end users provide when they contact the Government Body.
- Location information, such as historical precise geolocation and proximity data information. If you provide permission, we may use your device’s GPS and/or Bluetooth signals to determine your location. You choose whether to share your location, and can always revoke our access to your location data in your device settings, but some of our services may not function if we can’t access location data.
- Third-Party information, such as Google location data.
- Partner information, such as the designated Partner with whom an end user may elect to share personal information.
- Health-related information, such as self-reported symptoms related to a virus, including COVID-19.
- Other information that PathCheck does not specifically list here but that may be processed through the PathCheck GPS.
How We Use Your Personal Information
To operate the Service. We may use your personal information to:
- provide, operate and improve the Service such as informing you if you may have had approximate contact with another individual who has tested positive for the COVID-19 virus;
- communicate with you about the Service, including by sending you announcements, updates, security alerts, and support and administrative messages;
provide support and maintenance for the Service; and
- respond to your requests, questions and feedback.
To comply with law. We may use your personal information as we believe necessary or appropriate to comply with applicable laws, lawful requests, and legal process, such as to respond to subpoenas or requests from government authorities.
For compliance, fraud prevention, and safety. We may use your personal information and disclose it to law enforcement, government authorities, and private parties as we believe necessary or appropriate to: (a) protect our, your or others’ rights, privacy, safety or property (including by making and defending legal claims); (b) enforce the terms and conditions that govern the Service; and (c) protect, investigate and deter against fraudulent, harmful, unauthorized, unethical or illegal activity
To create anonymous, aggregated or de-identified data. We may create anonymous, aggregated or de-identified data from your personal information and other individuals whose personal information we collect. We make personal information into anonymous, aggregated or de-identified data by removing information that makes the data personally identifiable to you. We may use this anonymous, aggregated or de-identified data and share it with third parties, our Partners or others for our lawful business purposes.
With your consent. In some cases we may specifically ask for your consent to collect, use or share your personal information, such as when required by law.
How We Share Your Personal Information
Service providers. We may share your personal information with third-party service providers that provide services on our behalf or help us operate the Service (such as to provide and develop the PathCheck GPS or Safe Places software).
Other PathCheck GPS Users. We will alert users who were within nearby proximity of an affected user during the preceding 14 days. While this information does not directly identify you, there are circumstances when a user could identify you based on the location and time of contact. For example, this may occur if a user knows you personally and recalls that he or she met you at a specific location on a certain date.
Professional advisors. We may disclose your personal information to professional advisors, such as lawyers, auditors, and insurers, where necessary in the course of the professional services that they render to us.
For compliance, fraud prevention and safety. We may share your personal information for the compliance, fraud prevention and safety purposes described above. We will not proactively share your personal information with the government without your consent.
Business transfers. We may sell, transfer or otherwise share some or all of our business or assets, in connection with a business transaction (or potential business transaction) such as a merger, consolidation, acquisition, reorganization or sale of assets, or in the event of bankruptcy or dissolution.
In this section, we describe the rights and choices available to all users. Users who are located within the European Union can find additional information about their rights below. Your use of the PathCheck GPS is voluntary. At any time, you may request that we delete your personal information that may be in our possession by emailing your request to firstname.lastname@example.org.
Privacy settings and location data. We make available certain privacy settings on the Service, including options to control your sharing of personal information with a Partner. Users of our mobile application also have the choice whether to allow us to access your precise location data. Your device settings may provide the ability for you to revoke our ability to access location data. The PathCheck GPS will not function as a means for contact tracing and information sharing if you do not share your location history.
Do Not Track. Some Internet browsers may be configured to send “Do Not Track” signals to the online services that you visit. We currently do not respond to “Do Not Track” or similar signals. To find out more about “Do Not Track,” please visit http://www.allaboutdnt.com.
Choosing not to share your personal information. Where we are required by law to collect your personal information, or where we need your personal information in order to provide the Service to you, if you do not provide this information when requested (or you later ask to delete it), we may not be able to provide you with our services. We will tell you what information you must provide to receive the Service by designating it as required at the time of collection or through other appropriate means.
Other Sites, Mobile Applications and Services
The Service may contain links to other websites, mobile applications, and other online services operated by third parties. These links are not an endorsement of, or representation that we are affiliated with, any third party. In addition, our content may be included on web pages or in mobile applications or online services that are not associated with us. We do not control third party websites, mobile applications or online services, and we are not responsible for their actions. Other websites and services follow different rules regarding the collection, use and sharing of your personal information. We encourage you to read the privacy policies of the other websites and mobile applications and online services you use.
The security of your personal information is important to us. We employ a number of organizational, technical and physical safeguards designed to protect the personal information we collect. However, security risk is inherent in all internet and information technologies and we cannot guarantee the security of your personal information.
Please note that we are not a healthcare provider or other “covered entity” that is subject to the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and are not bound by its requirements for handling protected health information.
International Data Transfers
We are headquartered in the United States and may have service providers in other countries. Your personal information may be transferred to the United States or other locations outside of your state, province, or country where privacy laws may not be as protective as those in your state, province, or country.
European Union users should read the important information provided below about transfer of personal information outside of the European Union.
As a general rule, children under the age of 16 years old are not allowed to use the Service, and we do not collect personal information from them. If we learn that we have collected personal information of a child without the consent of the child’s parent or guardian, we will delete it. We encourage parents with concerns to contact us.
How to Contact Us
Please direct any questions or comments about this Policy or privacy practices to email@example.com. You may also write to us via postal mail at:
Attn: Legal – Privacy
58 Day Street
P.O. Box 441621
Somerville, MA 02144
Notice to European Users
The information provided in this “Notice to European Users” section applies only to individuals in Europe and the United Kingdom.
Processing Purpose and Legal Basis
Details regarding each processing purpose listed below are provided in the section above titled “How we use your personal information”.
- To operate the Service
- Legal Basis: Processing is necessary to perform the contract governing our provision of the Service. If we have not entered into a contract with you, we process your personal information based on our legitimate interest in providing the Service you access and request.
- For compliance, fraud prevention and safety; To create anonymous, aggregated or de-identified data
- Legal Basis: These activities constitute our legitimate interests. We do not use your personal information for these activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted to by law).
- To comply with law
- Legal Basis: Processing is necessary to comply with our legal obligations.
- With your consent
- Legal Basis Processing is based on your consent. Where we rely on your consent you have the right to withdraw it any time in the manner indicated when you consent, or in the Service.
Sensitive personal information. We ask that you not provide us with specific sensitive personal information (for example, information related to racial or ethnic origin, political opinions, religion or other beliefs, biometrics or genetic characteristics, criminal background or trade union membership) on or through the Service, or otherwise to us.
Personal information is retained in the PathCheck GPS for rolling fourteen (14) day periods. We may retain personal information for as long as necessary to fulfill the purposes for which we collected it, including for the purposes of satisfying any legal, accounting, or reporting requirements, to establish or defend legal claims, or for fraud prevention purposes.
To determine the appropriate retention period for personal information, we consider the amount, nature, and sensitivity of the personal information, the potential risk of harm from unauthorized use or disclosure of your personal information, the purposes for which we process your personal information and whether we can achieve those purposes through other means, and the applicable legal requirements.
When we no longer require the personal information we have collected about you, we will either delete or anonymize it or, if this is not possible (for example, because your personal information has been stored in backup archives), then we will securely store your personal information and isolate it from any further processing until deletion is possible. If we anonymize your personal information (so that it can no longer be associated with you), we may use this information indefinitely without further notice to you.
European data protection laws give you certain rights regarding your personal information. If you are located within the European Union, you may ask us to take the following actions in relation to your personal information that we hold:
- Access. Provide you with information about our processing of your personal information and give you access to your personal information.
- Correct. Update or correct inaccuracies in your personal information.
- Delete. Delete your personal information.
- Transfer. Transfer a machine-readable copy of your personal information to you or a third party of your choice.
- Restrict. Restrict the processing of your personal information.
- Object. Object to our reliance on our legitimate interests as the basis of our processing of your personal information that impacts your rights.
You may submit these requests by email to firstname.lastname@example.org or our postal address provided above. We may request specific information from you to help us confirm your identity and process your request. Applicable law may require or permit us to decline your request. If we decline your request, we will tell you why, subject to legal restrictions. For example, if we do not have personal information in our possession responsive to your request, we may not be able to fulfill your request. If you would like to submit a complaint about our use of your personal information or our response to your requests regarding your personal information, you may contact us or submit a complaint to the data protection regulator in your jurisdiction. You can find your data protection regulator here.
Cross-Border Data Transfer
Personal information processed through the PathCheck GPS is stored locally on your device. If you choose to share your personal information with a Partner, there is a direct transfer between you and the Partner. No personal information is transferred to PathCheck when information is transferred to a Partner. However, if we transfer your personal information out of Europe to a country not deemed by the European Commission to provide an adequate level of personal information protection, the transfer will be performed:
- Pursuant to the recipient’s compliance with standard contractual clauses, EU-US Privacy Shield (or Swiss-US Privacy Shield, as applicable), or Binding Corporate Rules;
- Pursuant to the consent of the individual to whom the personal information pertains; or
- As otherwise permitted by applicable European requirements.
You may contact us if you want further information on the specific mechanism used by us if we transfer your personal information out of Europe.