i-SENS Continuous Glucose Monitoring System Services Privacy Policy
i-SENS Continuous Glucose Monitoring System Services Privacy Policy
Last updated:[Aug 11, 2024]
i-SENS, Inc. (hereinafter referred to as ‘i-SENS’) has established and is disclosing the following Privacy Policy to protect users’ Personal Information that is collected and used when using i-SENS’s continuous glucose monitoring (hereinafter referred to as ‘CGM’) system services. The term 'i-SENS CGM System Services' or 'Services' collectively refers to the services provided through the Sens365 mobile and web applications. These services manage the blood glucose of users together with care providers on the basis of the mobile app for CareSens Air, which is a CGM system offered by i-SENS, and the collected data.
Summary of how i-SENS uses your personal information
Contents
1. General Provisions
2. Particulars of Personal Information to Be Collected and Method of Collection
3. Purpose of Collection and Use of Personal Information
4. Personal Information Retention and Use Period
5. Personal Information Destruction Procedure and Method
6. Measures regarding Destruction of Non-Users’ Personal Information
7. Provision of Collected Personal Information to Third Parties
8. Outsourced Processing of Collected Personal Information
9. Overseas Transfer of Collected Personal Information
10. Method of Setting Scope of Sensitive Information Disclosure
11. Users’ and Legal Representatives’ Rights and Method of Exercising Them
12. Matters regarding Installation, Operation, and Rejection of Personal Information Auto-Collection Devices
13. Matters regarding Processing of Pseudonymised Information
14. Other Policies on Personal Information Processing
15. Information on Privacy Officer
16. Method of Remedying Right Infringements of Data Subjects
17. Policy Amendments
1. General Provisions
i-SENS processes and manages users’ Personal Information in compliance with the provisions of the Personal Information Protection Act and other related statutes of the Republic of Korea and the EU General Data Protection Regulation (GDPR) (where individuals are located in the EU) and UK GDPR, and the UK Data Protection Act 2018 (where individuals are located in the UK) in order to protect the freedom and rights of users.
Therefore, we have established and are disclosing the following Privacy Policy in accordance with the applicable law.
This Privacy Policy is effective from [Aug 11, 2024]. Any amendments to this Privacy Policy will be publicly notified to users through an announcement on our website. Alternatively, users may be individually notified in writing, by email, text message, or other means.
This Privacy Policy describes how i-SENS Inc. and other companies in the i-SENS group (also referred to as ‘i-SENS’, ‘we’, or ‘us’) will make use of your Personal Information when you use i-SENS CGM System Services, including Sens365 applications.
It also describes your data protection rights, including the right to object to some of the processing which i-SENS carries out. More information about your rights, and how to exercise them is set out in the “Users’ and Legal Representatives’ Rights and Method of Exercising Them” section.
2. Particulars of Personal Information to Be Collected and Method of Collection
Services | Particulars of Personal Information Collected |
---|---|
i-SENS Integrated Member Account Management Website | [Required] Contact details (Name, email address (ID), phone number), Profile information (date of birth, gender, profile picture, country of residence, language, marketing preferences), User validation token information, mobile device information (device model, device OS information, unique device identifier), Account usage information (access IP information, log data, cookies, usage time) |
CareSens Air | [Required] Profile picture, connected blood glucose self-monitoring system information, event information (meals, exercise, note, photo), sensor information (unique sensor identifier, PIN code, hardware version, software version, model number, lot information, etc.), mobile device information (device model, OS information, unique device identifier, ring tone mode, notification activation status, Bluetooth activation status), app settings information (app name, version, package name, installed time and date, permissions, database version, local settings information, etc.), Account usage information (log data, cookies, usage time) [Sensitive Information (Optional)] Blood glucose (monitored by a sensor and self-monitored for correction), notification information, used event log information, event information (blood glucose, ketone, insulin, oral medications), diabetes type |
Sens365- 'Sens365 service for CareSens Air members' |
[Required] Contact details (Name, email address (ID), phone number), Profile information (date of birth, gender, profile picture, phone number, country of residence, language, roles, and permissions) connected sensor and blood glucose monitoring system information, event information (meals, exercise, note, photo), mobile device information (device model, OS information, unique device identifier), Account usage information (log data, cookies, usage time) [Sensitive Information (Required)] Blood glucose (monitored by a sensor and self-monitored for correction), diabetes type, event information (blood glucose, ketone, insulin, oral medications) |
Sens365- 'Sens365 service for care providers' |
[Required] Contact details (Name, email address (ID), phone number), Profile information (date of birth, gender, profile picture, country of residence, language, roles, and permissions), mobile device information (device model, OS information, unique device identifier), Account usage information (log data, cookies, usage time) |
The following Personal Information may be generated and collected while using the Services: Automatically generated information: app installation and deletion records, etc. The above automatically generated information may be processed with the user's consent, and it may also be automatically generated and collected when using the mobile app, computer web, and so on. |
i-SENS collects the Personal Information above during sign-up or login and through the use of the Services. Some of the information is mandatory and will be indicated during sign-up. Failure to provide this information may limit your use of some of the Services.
3. Purpose of Collection and Use of Personal Information
i-SENS processes Personal Information for the following purposes. The processed Personal Information is not used for any other purpose than those set forth below, and in the event of a change in the purpose of use, we will take necessary actions, such as obtaining a separate consent pursuant to Article 18 of the Personal Information Protection Act where required.
Purpose | Personal Data | Legal Basis (for UK/EU users only) For users who are not from the UK or EU, we rely on your consent as the legal basis. |
---|---|---|
For user identification and membership management:
|
Contact details, profile information, sensitive data | It is necessary for us to process your Personal Information in order to perform our contract with you or to take steps at your request prior to entering into a contract with you. For sensitive information, we rely on your consent. |
For managing membership, including compliance with our policies:
|
Contact details, profile information, account usage information | We have a legitimate interest in enforcing our policies and terms in order to protect ourselves and our users. |
For CGM System Services provision
|
Profile information, mobile device information, sensitive information | It is necessary for us to process your Personal Information in order to perform our contract with you or to take steps at your request prior to entering into a contract with you. For sensitive information or use of device information, we rely on your consent. |
For the integration of i-SENS products and services into your health care:
|
Contact details, profile information, sensitive information | We have a legitimate interest in making our products and services accessible to your healthcare team to improve your healthcare options. For sensitive information, we rely on your consent. |
For service improvement
|
Mobile device information, sensor information, account usage information, profile information (for preferences information) | We have a legitimate interest in improving our products and services. Where we use cookies and similar technologies to collect this information, we rely on your consent. |
For customer services
|
Contact details, profile information, content of communications to customer services, account usage information, sensor information, sensitive data | We have a legitimate interest in responding to queries and complaints from customers and to keep customers informed of updates to our services. For sensitive information or use of device information, we rely on your consent. |
For research purposes, described in Section 13 below:
|
Pseudonymised profile information (gender, age, etc.), blood glucose value, measurement time information, used device information, event input information | For sensitive information or use of device information, we rely on your consent. |
For EU Users Only
There are instances where we have a legitimate interest to use your Personal Information. Our legitimate interest will vary depending on what we are using your Personal Information for, and we explain above what the interest is and how it relates to the processing operations that we are carrying out. Where we process Personal Information on the basis of a legitimate interest, then – as required by data protection law – we have carried out a balancing test to document our interests, to consider what the impact of the processing will be on individuals and to determine whether individuals' interests outweigh our interests in the processing taking place. You can obtain more information about this balancing test by using the contact details at the end of this Privacy Policy.
Additional Use and Provision
For Korean users, i-SENS may additionally use and provide Personal Information without the user’s consent in consideration of the matters provided in Article 14-2 of the Enforcement Decree of the Personal Information Protection Act pursuant to Articles 15(3) and 17(4) of the Personal Information Protection Act. i-SENS has considered the following matters in order to use and provide Personal Information without the user's consent:
4. Personal Information Retention and Use Period
The retention and use periods of each type of Personal Information are as follows:
Provided that, in any of the following cases, the period will be until the termination of the relevant case:
In the case of information of a member who is found to have committed a misconduct, until 180 days following membership termination
In the case of a pending investigation, examination, etc., owing to the violation of a related statute, until the closing of such investigation or examination
In the case of a debtor-creditor relationship resulting from the use of the home page and remaining in effect, until the settlement of such a debtor-creditor relationship
Records of transactions, such as indications and advertisements, the terms and performance of contracts, etc., under the Act on the Consumer Protection in Electronic Commerce
- Records of indications and advertisements: 6 months
-Records of contract or subscription withdrawals, payments, the supply of goods, etc.: 5 years
- Records of consumer complaints or dispute handling: 3 years
Retention of communication confirmation data under the Protection of Communications Secrets Act
- Time and date of telecommunications by subscriber, start and end time of telecommunications, the subscriber number of the other party, frequency of use, location-tracking data of the transmitting base station: 1 year
- Computer communications or Internet log records, access point tracing data: 3 months
Scientific research and statistical preparation using pseudonymised information: Until fulfilment of purpose
5. Personal Information Destruction Procedure and Method
In principle, i-SENS destroys users’ Personal Information without delay when such Personal Information becomes unnecessary owing to the lapse of its retention period, the achievement of the purpose of processing, etc. However, when Personal Information must be continuously retained under other statutes or at the user’s request (see 4. Personal Information Retention and Use Period above), such Personal Information is moved to a separate database or other storage location. The Personal Information that is moved to a separate database or storage location is not used for any purpose other than the purpose for which it is kept unless otherwise provided by law.
Destruction Procedure
i-SENS selects the Personal Information that must be destroyed and destroys the Personal Information after obtaining the approval of i-SENS’s Privacy Officer.
Destruction Method
Any Personal Information that is saved in electronic file format is deleted using a technical method that renders the records unrecoverable. Any Personal Information that is in written form or printed on paper is destroyed by shredding it with a shredder.
6. Measures Regarding Destruction of Non-Users’ Personal Information
i-SENS converts any user who does not use the Services for one (1) year to an inactive account and stores their Personal Information separately applying the same security measures to as to Users’ Personal Information. The Personal Information that is stored separately may be destroyed after one (1) year of storage, unless the statutes require otherwise.
i-SENS notifies users who are expected to be converted to inactive accounts of the fact that their Personal Information is to be stored separately, the expected date of inactive conversion, and the Personal Information particulars that are separately stored. This notification is sent using a method that can be used by the users, such as email, text message, etc., no later than thirty (30) days prior to inactive conversion.
If you do not wish to have your account converted to an inactive account, all you need to do is sign in to the Services before your account is converted to an inactive account. Also, even after your account is converted to an inactive account, if your Personal Information has not been destroyed, you can use the Services as usual by logging in to your inactive account and consenting to its reactivation.
7. Provision of Collected Personal Information to Third Parties
i-SENS provides Personal Information to third parties (other than i-SENS’s service providers, more details of which can be found in the following section) only in cases where i-SENS has obtained the user’s consent or pursuant to special provisions of the applicable law and does not otherwise provide Personal Information to a third party without the user’s consent.
i-SENS also provides Personal Information and Sensitive Personal Information of a user to Care Providers that use 'Sens365 service for care providers' upon a user’s request.
If a user wishes to use the services of an external partner company, i-SENS will provide Personal Information to the external partner company to the minimum extent necessary after obtaining the user’s express consent. Click here* to see the external partner companies and other third parties to which i-SENS currently provides users’ Personal Information. In the event any third party to which Personal Information is provided is added or changed, we will obtain users’ consent to such addition or change and notify you of the same through an announcement on our website (or individually notify you by email, etc.)
i-SENS may provide Personal Information to a related agency without the users’ consent in the case of an emergency, such as a disaster, infectious disease, an event/accident causing imminent danger to life or body, imminent property loss, etc., pursuant to the Rules on the Processing and Protection of Personal Information in Emergencies jointly announced by the related government ministries. For more information, click here*.
8. Outsourced Processing of Collected Personal Information
i-SENS outsources some of its work to external companies, such as cloud hosting providers, in order to provide convenient and better services. i-SENS specifies matters regarding the prohibition of the processors‘ processing of Personal Information for a purpose other than the purpose of the outsourced work, technical and managerial protection measures, the limitation of re-outsourcing, the management and supervision of the processors, and the processors’ damages and other liability under Article 26 of the Personal Information Protection Act in writing such as in contracts, etc., and supervises whether the processors safely process the Personal Information. If a user does not use the Services related to the work outsourced by i-SENS to a processor, the user’s Personal Information is not provided to the processor.
i-SENS may share your Personal Information with law enforcement and fraud prevention agencies without your consent if necessary to prevent, investigate and/or report fraud, terrorism, misrepresentation, security incidents or crime, in accordance with applicable law.
Outsourcing of Personal Information Processing
The external company to which i-SENS currently outsources the processing of users’ Personal Information is as follows. If the description of the outsourced work or the processor changes, we will notify you of such change through an announcement on our website. If required by applicable data protection laws, we will also notify you individually by email.
Processor | Description of Outsourced Work |
---|---|
Amazon Web Service Korea LLC | infrastructure operation/management, data storage and backup |
The Constant Company, LLC | infrastructure operation/management, data storage and backup of data |
[For EU/UK users] Distributors located in EU Region |
process customer data on behalf of i-SENS for the purpose of providing service to users |
9. Overseas Transfer of Collected Personal Information (Including Outsourced Processing)
In order to perform the Services, i-SENS outsources the processing of Personal Information to a foreign specialising company as set forth below. As mentioned in 8. Outsourced Processing of Collected Personal Information above, when the processing of Personal Information is outsourced, we supervise the processor to ensure the safe processing of Personal Information so that Personal Information can be securely protected.
For EU or UK users: Due to the global nature of our business, your Personal Data will be disclosed to group companies outside of the UK and the EEA, including, in particular, the Republic of Korea. We ensure appropriate safeguards are in place to protect the transfer of your Personal Data to countries where there does not exist an adequate level of data protection. Our initial collection of data in Korea is not a transfer of your data. However, to the extent that we transfer your Personal Data within Korea, we rely on the respective adequacy decisions of the EU Commission and the UK government.
No identifiable data will be transferred outside of the UK and the EEA, unless it is pseudonymised. All identifiable data is stored within the UK or the EEA, the primary data storage is in Germany. Back-ups are also stored within the UK or the EEA. In order to deliver third line support a non UK or EEA employee may access the data to deliver technical or customer support. This would be in limited and if required no personal identifiable data would be stored locally.
10.Method of Setting Scope of Sensitive Information Disclosure
i-SENS provides users’ sensitive information to the National Health Insurance Service or other third-party service provider only with the users’ separate consent. i-SENS does not disclosure any user’s sensitive information unless the user’s separate consent has been obtained or it is required by statute. Therefore, users may choose not to consent to the provision of sensitive information to third parties, in which case sensitive information is not disclosed to any third party.Users may direct any question related to the scope of sensitive information disclosure and any request for a change of the disclosure scope settings or non-disclosure to the department and person in charge of Personal Information protection stated below:
11.Users’ and Legal Representatives’ Rights and Method of Exercising Them
Users and legal representatives may exercise the following rights in connection with the registered Personal Information of the users:
In the event the services of an external account are used by linking them with an i-SENS Services account, the external account can be delinked from ‘Member Information’. The information collected by us through the external account link can be changed from the page for managing external accounts, such as Google, KakaoTalk, etc., and is deleted when the user terminates their linked i-SENS member account.
Pursuant to the Personal Information Protection Act and the GDPR, a user can exercise the above rights by calling the main telephone number (02-910-0600) or by contacting the Privacy Officer or the department in charge of Personal Information protection by using the details in the section below at any time.
However, for Korean users, when a user demands the perusal, transmission, or suspension of processing of their Personal Information, their rights may be limited by Articles 35(4), 35-2(6), (7), and 37(2) of the Personal Information Protection Act. When a demand for perusal, a demand for transmission, a demand for correction/deletion, or a demand for the suspension of processing is made on the basis of a user’s rights, i-SENS confirms whether the person making the demand for perusal, etc., is the user themselves or a legitimate representative of the user.
If a user requests the correction of an error in Personal Information, such Personal Information is not used or provided to a third party before the correction is completed. Also, in the event the incorrect Personal Information has already been provided to a third party, we will notify the third party of the correction processing results without delay. However, in the case of a demand for correction and deletion of Personal Information, a user may not demand the deletion of Personal Information if such Personal Information is expressly required to be collected by other statutes.
For EU/UK users:
These rights may be limited. For instance, if fulfilling your request would reveal personal data about another person or if you ask us to delete information that we are required by law or have compelling legitimate interests to keep.
Wherever we rely on your consent, you have the right to withdraw that consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal. We may, however, have other legal grounds for processing your data for other purposes, such as those set out above.
You have an absolute right to opt-out of direct marketing, or profiling we carry out for direct marketing, at any time. You can do this by following the instructions in the communication where this is an electronic message, or by contacting us using the details set out below.
If you have any outstanding issues, you are entitled to file a complaint with a data protection authority in the country you live in, your place of work, or the country where the alleged infringement occurred.
12.Matters Regarding Installation, Operation, and Rejection of Personal Information Auto-Collection Devices
i-SENS uses cookies to save and retrieve user information. When you visit our website, a cookie is sent to your browser and saved on your computer or mobile device.
Purpose of Using Cookies, etc.
We use cookies for the purpose of providing essential services and safety features.
Method of Rejecting Cookies
Users have the right to select their cookie settings. They can choose to allow all cookies, confirm every time cookies are saved, or reject all cookies by setting the options from their web browsers.
If a user rejects cookies, it may be difficult for us to provide certain features of the Services to that user.
As an example, the settings of Microsoft Edge can be set as follows:
Select ‘Cookies and site permissions’ from the Settings menu. Click ‘Manage and delete cookies and site data’. Specific cookie controls can be set here.
Select ‘Cookies and site permissions’ from the Settings menu. Click ‘Cookies and saved data’. Click ‘See all cookies and site data’.
Select ‘Cookies and site permissions’ from the Settings menu. Click ‘Manage and delete cookies and site data’ to reject cookies.
13. Matters Regarding Processing of Pseudonymised Information
i-SENS processes Personal Information as set forth below by pseudonymising it so that specific individuals cannot be identified from such information to research and develop better products and services for achieving our business purpose, such as preparing statistics, conducting academic research, preserving records for the public good, conducting market research, etc. When doing so, we save and manage the pseudonymised information separately from any additional information to prevent it from becoming re-identifiable and take the necessary technical and managerial protective measures (see 14. Other Policies on Personal Information Processing below).
Matters Regarding Pseudonymised Information Processing
Classification | Purpose of Processing | Particulars Processed | Retention and Use Period |
---|---|---|---|
Statistics Preparation | To analyse and study the demographics and usage patterns of users of CareSens Air offered by i-SENS | De-identified user profile (gender, age, etc.), blood glucose value, measurement time information, used device information, event input information | Until fulfilment of purpose |
Academic Research | To study the blood glucose value improvement effect based on the method of use of users of CareSens Air offered by i-SENS | De-identified user profile (gender, age, etc.), blood glucose value, measurement time information, used device information, event input information | Until fulfilment of purpose |
14.Other Policies on Personal Information Processing
Technical and Managerial Measures for Securing Safety of Personal Information
i-SENS takes the following measures to secure the safety of Personal Information:
i-SENS has adopted the following technical and managerial measures to secure the safety of users’ Personal Information when processing the same to ensure that Personal Information is not lost, stolen, leaked, altered, or damaged.
i-SENS has established and implemented an internal management plan to safely process Personal Information.
i-SENS takes corrective measures immediately upon detecting an issue after confirming the performance of Personal Information protective measures and the compliance by the persons in charge through an internal organ dedicated to Personal Information protection.
Devices i-SENS controls unauthorised access from outside using an intrusion prevention system and strives to furnish all possible technical devices to otherwise maintain system security.
i-SENS stores and manages access records on the Personal Information processing system and uses security features that prevent the forgery and alteration of access records.
A user’s Personal Information is protected by their password. File and transmission data are saved and managed using encryption or the file lock feature. Important data is protected through a separate security feature.
i-SENS takes measures to prevent damage caused by a computer virus by using a vaccine program. The vaccine program is regularly updated, and when a virus suddenly appears, the program provides a vaccine as soon as it is ready, thereby preventing the breach of Personal Information.
i-SENS has adopted a security device (SSL) that enables the safe transmission of Personal Information on a network using a cryptographic algorithm.
To prepare for external intrusions, such as hacking, we are doing everything we can to achieve perfect security by using an intrusion prevention system and a vulnerability analysis system for each server.
We do not store Personal Information together with general data but keep it separately on a separate server.
i-SENS limits the permission to access users’ Personal Information to those conducting marketing directly targeting the users, those managing Personal Information, such as the Privacy Officer, the persons in charge, etc., and those whose handling of Personal Information is otherwise inevitable owing to the work performed by them.
We provide regular in-house education and externally outsourced education on new security technologies and the obligation to protect Personal Information, among others, to employees who handle Personal Information.
We prevent the leakage of information by persons in advance by requiring all employees to sign a confidentiality agreement upon joining the company and have an internal procedure in place for auditing the performance of the Personal Information Protection Policy and employees’ compliance therewith.
The transfer of the duties of persons handling Personal Information take place thoroughly while maintaining security, and employees are clearly informed of the liability that arise out of Personal Information-related accidents after they join and leave the company.
Access to the computer room, the data storage room, etc., is controlled by designating them as special protection areas.
Post Operation Policy
i-SENS values users’ posts, and we do our best to protect them so that they are not altered, damaged, or deleted. However, this does not apply to any of the following posts:
To promote a desirable posting culture, i-SENS may delete a particular section or redact it using symbols, etc., when a user discloses the personal matters of another person without the latter’s consent. If any post can be moved to another bulletin board with a different topic, we make sure that there is no misunderstanding by showing where the post was moved to.
In other cases, we can delete posts after giving express or individual warnings.
Basically, all rights and liability related to a post lies with the person who wrote it. Also, it is difficult to protect any information that is voluntarily disclosed through a post, so please think carefully before disclosing any information.
15. Information on Privacy Officer
i-SENS has designated the following person as the Privacy Officer to oversee and take charge of the work related to Personal Information processing and to handle any questions or complaints filed by users in connection with Personal Information processing. Please contact the Privacy Officer or the department in charge if you have any question, complaint, advice, etc., related to Personal Information protection while using the home page, etc.
Privacy Officer
Department and Person in Charge of Personal Information Protection
16.Method of Remedying Right Infringements of Data Subjects
A user can file all complaints related to the protection of Personal Information that arise while using the Services of i-SENS with the Privacy Officer or the department in charge. i-SENS will respond to users’ complaints.
If you need to file a report or get counselling on other breaches of Personal Information, please direct your questions to the following agencies:
For Korean users
For EU users
For UK users
17. Policy Amendments
We reserve the right to update this Privacy Policy at any time, and we will provide you with a new privacy notice when we make any substantial updates. We may also notify you in other ways from time to time about the processing of your Personal Information.
Addendum
Effective Date of this Privacy Policy: [Aug 11, 2024]