BRIDGe - Privacy Policy

Pursuant to and for the purposes of art. 13 and 14 of the European Regulation (EU) 2016/679 (General Data Protection Regulation), LYOTECH SRL protects and respects your personal data. In order to protect people and other subjects regarding the processing of personal data, and in relation to the information that will come into possession, we inform you as follows:

1. Data Controller 2
2. Purpose and recipients of the processing 2
3. Data processed 4
4. 3.1 Personal data  4
5. 3.2 Monitoring data  4
6. 3.3 Monitoring Extensions 5
7. 4 Methods of data processing  6
8. 4.1 Transfer, storage and processing of data  6
9. 4.2 Processing for research purposes  6
10. 4.3 Website and cookies 6
11. Rights of data subjects 7
12. Duration of treatment 7
13. Changes to the legislation 7

1. Data Controller

1.1 Data controller: LYOTECH SRL, Corso Unità d'Italia 10, 22063 Cantù (CO), Italy

1.2 To exercise the rights indicated below, the interested party can contact the data controller preferably at the dedicated email address privacy@lyotech.it or, alternatively, by registered mail to “DPO LYOTECH SRL, Studio Mascheroni e Brianza, Corso Unità d'Italia 10, 22063 Cantù (CO), Italy”.

2. Purpose and recipients of the processing

• BRIDGe is a non-intrusive monitoring service that allows you to estimate the quality of life (Health Related Quality of Life) of frail people (subjects monitored) in their living environment, with the aim of communicating this information to family members and caregivers (observers) to foster a feeling of "mutual tranquility" between the parties.

• LYOTECH it respects the privacy of its customers, especially when it comes to fragile people. The collection, processing and communication of the data in question to the observers is carried out for the sole purpose of detecting any critical issues in the behavior of the monitored subject that are relevant to improve their quality of life. For this reason, the data processed is limited only to the data necessary for the purposes described above.

• BRIDGe provides for the use of home automation sensors (see section 3 - Data processed) based on the specific needs of the monitored subject who must expressly consent to the monitoring in their living environment (monitored apartment), under penalty of disabling the service. The information collected and processed by means of a technological system will be transmitted to the observers via a mobile application. The installation of the technological infrastructure necessary for the installation of the service in the monitored apartment must be expressly authorized by the owner of the same (owner). The monitored subject must appoint a person responsible for the management of the service (supervisor - it can be the monitored subject itself or a third party), who will be provided with access credentials to the BRIDGe portal to configure the system and appoint the observers.

• All those who do not usually stay in the monitored apartment (guest subjects) and of which no data is collected that allows their identification, are not to be considered interested in the treatment as BRIDGe does not process data attributable to their person. It is the task of the supervisor to deliver this information to all monitored subjects, observers and guests, and to obtain informed consent where necessary.

• Any domestic collaborators, educators and anyone carrying out a professional activity that involves non-occasional stay in the monitored apartment is to be considered on a par with the monitored subjects, and therefore it is the task of the supervisor to provide this information and obtain informed consent.

The recipients of the treatment - the data subjects - are the monitored subjects, the supervisors, the observers and the owners.

IN SHORT:

3. Data processed

3.1 Personal data

3.1.1 In order to guarantee registration and use of the service, the monitored subject and the supervisor must provide the following self-certified identification data: Name, Surname, Fiscal Code, Sex, Address of residence, place and date of birth, Method of payment.

3.1.2 This information is stored in paper and / or digital format; LYOTECH adopts appropriate technical and organizational procedures to guarantee the protection of personal data provided by customers.

3.1.3 Customers' personal data are not transferred to third parties.

3.2 Monitoring data

3.2.1 The system collects data relating to the activation of home automation sensors installed in the living environment of the monitored subject. The quantity and variety of data processed depends on the number and type of sensors installed; the system configuration is the responsibility of the service management manager (possibly recommended by LYOTECH personnel) according to the needs of the monitored subject. The following table illustrates the data that BRIDGe can process:

3.2.2 The data collected by BRIDGe through the use of environmental sensors are to be considered impersonal as they are not attributable to the activity of an identifiable physical subject. In this configuration, the events and information collected could be attributed to a known subject only by making an estimate based on the knowledge of additional information on the identity and habits of all those who frequent the monitored environment.

3.2.3 The collected data are processed through Machine Learning and Artificial Intelligence algorithms for the sole purpose of estimating the psychophysical condition of the monitored subject and communicating it to the respective observers in the simplest way according to the purposes of the treatment.

3.3 Monitoring Extensions

• Integration of wearable tracking systems / mobile app

• BRIDGe provides for the integration of localization systems that use wearable sensors and / or mobile applications to collect information relating to the location of the monitored subject in indoor and outdoor environments; these data are used to estimate the psychophysical conditions of the monitored subject.
• The use of these localization systems is optional and must be expressly authorized by the monitored subjects and the supervisor.

• Integration of night monitoring

• BRIDGe involves the use of sensors for monitoring some characteristic parameters of sleep quality: movement, heart rate, respiratory rate. These data are obtained using an environmental sensor installed on a bed and are not attributable to an identifiable physical subject, but to anyone who uses this bed.
• The use of these sensors for night monitoring is optional and must be expressly authorized by the monitored subjects and the supervisor.

3.3.3 Camera integration

• BRIDGe provides for the use of cameras to allow observers to better assess the need to intervene promptly in the monitored environment in conditions of need.
• The use of the cameras is optional and must be expressly authorized by the monitored subjects and the supervisor.

3.3.4 Integration with Amazon Alexa

• BRIDGe provides for the integration of Amazon Alexa devices through the use of an appropriate Amazon Skill developed by LYOTECH; this skill allows an observer to receive information on the related monitored subjects, set reminders and questionnaires that will be reproduced by the Amazon Alexa devices within the monitored environment.
• The use of Amazon Alexa devices is optional and observers, in agreement with the supervisor, can decide at any time whether to use or suspend integration with Amazon Alexa.
• The use of the Skill requires to link the Amazon identity of the user (observer) with a BRIDGe user; this procedure is possible through the “Account Linking” procedure that can be performed with the Amazon Alexa app. This association is removable at any time from the Amazon Alexa app
• The use of the Skill entails the access by the Skill of the monitoring data relating to the connected user during the "Account Linking" phase.
• For more information on Amazon Alexa products, on the processing of data in the use of Amazon Skills and on users' rights regarding compliance with the GDPR regulations, please refer to the Amazon information.

4 Methods of data processing

4.1 Transfer, storage and processing of data

4.1.1 AUTHORIZATION SERVER

Personal data is stored on a server within the EU, together with the authorizations granted by the monitored subjects and supervisors. Access to their personal data is allowed to interested parties through a special WEB interface accessible using the credentials provided when the service is activated.

4.1.2 DATA SERVER

The monitoring data is processed and stored on a server within the EU that is physically and geographically separate from the AUTHORIZATION SERVER. The association between the personal data of a monitored subject and his / her personal data is entrusted to a pseudonymised code that does not allow unauthorized subjects to infer the belonging of the monitoring data. The monitoring data can only be used by observing users via the BRIDGe mobile application by entering their credentials.

The monitoring data collected can be processed externally to LYOTECH SRL by specialized companies and / or external persons within the EU who act on their behalf as long as they are previously anonymized and in any case in full compliance with art. 13 and 14 of the European Regulation (EU) 2016/679.

4.1.3 SECURITY IN DATA PROCESSING

Data transfer takes place through encrypted communication protocols (SSL-HTTPS).

All passwords of BRIDGe service users are encrypted.

All data processed are stored using encrypted and password protected databases.

4.2 Processing for research purposes

4.2.1 The monitoring data are also stored in anonymous and aggregate form for research purposes. The results of the research can be disseminated in conference / conference proceedings and in scientific and / or popular newspapers / publications. This information will be treated anonymously and aggregated without allowing the identification of any individual.

 4.3 Website and cookies

4.3.1 While browsing the website, the computer and the software involved in the functioning of the site acquire some data during their normal use, the transmission of which is implicit in the use of Internet communication protocols. These data are anonymous, but can allow users of the website to be identified (for example the IP address used to visit our website) through associations with data held by third parties.

4.3.2 The data is processed for the time necessary to obtain statistical information on the use of the site and to verify the correct use of this site. Subsequently, the data are generally removed from the network and stored offline exclusively to ascertain any responsibility in the event of hypothetical computer crimes and can only be consulted at the request of the judicial authority.

4.3.3 WEB applications use session cookies and persistent cookies in order to manage the communication between devices and the service itself in complete safety. The types of cookies directly generated are technical cookies, used for:

1. The authentication and management of a browsing session (for example, for identify and validate the user for viewing personal data);
2. Security purposes (for example, to take into account the number of failed logins, identifying possible authentication abuses and preventing fraud).

• If BRIDGe WEB applications are used, cookies can be managed by the user through their browser. The user can manage their cookie preferences through the features present in common browsers (Internet Explorer, Microsoft, Edge, Mozilla Firefox, Google Crome, Apple Safari), which allow you to delete / remove cookies (all or some) or to change the settings of the browser itself in order to block the sending of cookies or to limit it to specific sites (compared to others). It is possible to find out how to configure the browser settings (usually accessible from the "Tools" bar) by going to the "Support" web pages of the suppliers of the aforementioned browsers (also identifiable through a common search engine). Disabling cookies does not in itself preclude the use of the Website services; if, however, all cookies are deleted / blocked, including the technical ones, some operations could not be carried out or would be more complex and / or less secure, such as, for example, for the execution of activities within the Site (cookies allow to carry out and maintain the identification of the user in the context of the session).

5. Rights of data subjects

As interested parties, the monitored subjects and supervisors enjoy the rights referred to in Regulation (EU) 2016/679. The interested party has the right to:

• right to information - right to obtain information on which data are processed by the owner;
• right of access - right to request and obtain the data held by the owner in an intelligible form;
• right to update and rectify - right to obtain the updating or correction of the data provided;
• right to be forgotten - right to obtain the deletion of datain possession of the holder. This option results in the termination of the monitoring service *;
• right to object - right to oppose the processing: no further data concerning him will be collected, without prejudice to the use of any data already collected to determine, without altering them, search results or those that, originally or following processing, are not attributable to an identified or identifiable person. This option results in the termination of the monitoring service *;
• right to withdraw consent - right to revoke the consentat any time without prejudice to the lawfulness of the processing based on the consent given before the revocation. If you object to the processing of data essential to the use of the service, this option implies the end of the monitoring service *;
• right to request and obtain the blocking or limitation of data processed in violation of the law and those whose retention is no longer necessary in relation to purposes of the processing.

With regard to the exercise of these rights, the interested party can use the tools made available to the user via the BRIDGe web application (where provided), or write an email toprivacy@lyotech.it or, alternatively, by registered mail to “DPO LYOTECH SRL, Studio Mascheroni e Brianza, Corso Unità d'Italia 10, 22063 Cantù (CO), Italy”.

* TERM OF THE MONITORING SERVICE: Upon termination of the monitoring service, the personal data of the interested parties will be immediately deleted, as well as all information related to them (geo-location where present). With regard to non-sensitive, anonymized monitoring data, and therefore not attributable to any user, these will be processed solely for research purposes for the purposes and within the terms set out in this statement. If the monitored subject or the responsible subject exercise a right that entails the termination of the monitoring service, LYOTECH has the right to maintain contact with the responsible subject to request any compensation caused by the early termination of the subscription in accordance with the provisions of the contract during the activation of the BRIDGe service.

6. Duration of treatment

The personal and monitoring data of the interested parties will be stored in the manner described in this information for the entire duration of use of the BRIDGe service by the interested parties, and in any case until the termination of the contract stipulated during the signing phase. At the end of this period all personal data will be destroyed.

Non-sensitive anonymized monitoring data, and therefore not attributable to any person, will be kept for research purposes as described in section 4.2, and in any case for a period of less than 10 years.

7. Changes to the legislation

Any changes to this legislation will be communicated via email to the address registered during the acceptance phase of the same. It is possible to request the updated legislation at the addressprivacy@lyotech.it or view it from the BRIDGE web application. This policy was updated on: September 22, 2021.