What we do with your data, and what you agree to

Please read this before you create an account. It is the only document about your data that you need to read to use the app. "The app" here means the OLTAIR mobile app and its web version alike; this document applies to both. At the end you choose what you agree to.

Before you agree

• OLTAIR asks you about your health and habits, reads what your phone and watch measure, and shows you how you are living. It is for adults, and it is free for study participants.
• It is not a medical device. It does not diagnose, treat, cure or prevent any medical condition.
• One agreement is needed to create your account: without it we may not hold health data at all. Everything else we ask is a separate choice, the app works the same whichever way you answer, and you can change any choice later.
• We will ask you to let your data be used for health research — research into how the way people live relates to their health. Some of that research is paid for by companies. What they receive is statistics, invented datasets and models built from many people's data, not your individual record. Approved analysts may work on your coded record inside our own system, only if you separately agree, and no copy of it leaves.
• We are a private company and we are paid for the research work built on this data. There is no payment for taking part unless the terms of the study you are in provide for one.
• You can leave at any time and have your data deleted.

1. Who we are

OLTAIR Systems Czech s.r.o., Šemberova 73/10, 779 00 Olomouc, company number 24604712, decides how your data is used and holds it. We are owned by OLTAIR Systems, Corp. in the United States.

For study participants the app is free. We are financed by our owners, investors, grants and income from the research work described in section 5.

We run the website and the app as processor for the research institutions that conduct the studies in it: for the NIKOL study, that is Univerzita Palackého v Olomouci. For the study, what you fill in belongs to the university, is governed by the university's own documents and not by this one, and we handle that information on the university's instructions.

We keep the same answers for ourselves as well. The study's questions are our questions too, so what you answer goes into your own OLTAIR record and is used for whatever you agree to in section 6 — and for nothing you do not. Refuse any of it and we still hold those answers for the university, because the study needs them, and your part in the study is unaffected.

Write to us about the app at [email protected]. Our data protection officer is an external retainer, at [email protected]. You can write to them about anything here, and they answer you independently of the rest of the company. You can also complain to the Úřad pro ochranu osobních údajů, Pplk. Sochora 27, 170 00 Praha 7, uoou.gov.cz.

2. What the app does, and what it is not

It keeps your answers in one place, shows simple indicators of how you are living, runs an assistant that explains them, and prepares a summary you can download and give your doctor.

That summary is a copy of your own answers and readings. No doctor has checked it.

The indicators describe your lifestyle. They are not a clinical measurement and not a second opinion. Talk to a doctor about anything that worries you, and never delay seeing one because of what the app showed you. In an emergency call 155 or 112.

If we ever certify part of the app as a medical device, we will tell you what changes, and ask you again where the law requires it.

3. What we collect

• Your answers — about your health, habits, surroundings and daily life, including the answers you fill in for a study running in the app.
• Readings from your phone and wearable — steps, distance, energy used, heart rate, heart-rate variability, resting heart rate, breathing rate, blood oxygen, sleep, and skin and body temperature.
• Your region — which Czech region you are in. Not your address and not your position.
• Photos of food, drink and products you choose to add, and what we read from them. Your phone strips the location tag before the picture reaches us. Please do not photograph other people.
• Your conversations with the assistant, including the recording and transcript if you speak.
• Results and documents you add yourself — a laboratory result or a doctor's report, for example — and what we read from them.
• Orders — if you buy something from us: what, where to send it, and the payment record from the payment provider; card details do not reach us.
• Account data — your name and surname, date of birth, email address, password, language, and records of sign-ins and errors. If you joined a study through bank identity (Bank iD), we take your name, surname, date of birth and email from it so that we do not ask you again. We do not keep your birth number: bank identity passes it to us only when you choose the health-registry link in the study, and even then it goes only into the study's record, not into your OLTAIR account.
• Usage measurements — which screens are opened and when the app fails, so we can fix it. This tool cannot see screens that hold health data.

We add public information about your region, such as weather and air quality, so a reading can be read in context. The app contains no advertising trackers.

Readings reach us by three routes, and the difference matters.

1. Through your phone's health store — Apple Health, or Health Connect on Android. That store asks your permission separately and lets you choose which categories to share; you can change it there at any time. On Android, connecting also reads the previous 30 days.
2. Directly from the maker of your device, through its own service, if you connect it that way.
3. From another OLTAIR product you use.

Readings arriving by the first route are used only to run the app for you, to improve the app itself, in our own published research, to check whether a study invitation is worth showing you if you tick the fourth choice, and in a study you join, under its own consent. They, and anything computed from them, are never sold, never given to an advertising platform, a data broker or anyone who resells data, and never part of the research outputs or the secure environment described in section 5. Readings arriving by the other two routes do not carry those limits.

4. What we use it for

To run the app for you. We turn your answers and readings into your indicators, run the assistant, and prepare your summary.

To improve the app and develop our other products and services. We use your data, with a code in place of your name, to test the app, fix what is broken, train the models that run inside it, and develop new OLTAIR features, products and services. A trained reviewer may read assistant conversations for this. Nothing built this way goes to anyone outside OLTAIR.

For our own research. We study how the way people live relates to how their health changes. Our independent ethics committee, most of whose members are from outside OLTAIR, approves each project and lists it publicly before it starts. Results are published without naming anyone, and once a year we publish a note on what the data was used for. For each project, its funding and any conflicts of interest are recorded in its ethics submission and published with its results. This use of the information continues for as long as you keep your account and this choice ticked. It brings you no direct benefit.

To tell you about studies run by other organisations, and to check your data against a study's entry rules to decide whether an invitation is worth showing you. The organisation running the study learns nothing about you unless you join it, under its own consent. The organisation sets the entry rules and OLTAIR runs the check, so the two of us are responsible for that check together; each invitation names the organisation, and you can raise anything about the check with either of us. We keep a note of which studies you joined, so we do not offer them again. Joining a study and the choices in this document do not depend on each other: you can join a study whatever you tick here, and refusing any choice here changes nothing about your participation in a study.

To communicate with you. Messages the service needs — a new study wave is due, this document has changed, something happened to your account — we send by email and in-app notification; the service cannot run without them. We may also write to you about our own products and news, by email or in-app notification; you can decline any such message in one step and switch them off in Settings. We give your contact details to nobody else for their marketing.

To run the service safely. We keep security logs, usage measurements, the record of what you agreed, and support messages. We do this because a service like this cannot be run safely or shown to be lawful without it. That is our own interest rather than your agreement, and you can object at any time by writing to the data protection officer named in section 1.

Your account — your name, date of birth, email address, password and settings — we keep because we cannot run an account without them or show that it is yours.

Which rule lets us do what. The six choices in section 6 rest on your consent. Your account and your orders rest on our contract with you. Accounting and tax records and complaint records we keep because the law requires it. Security, usage measurement, service messages and messages about our own products rest on our legitimate interest — you can object to any of them through the data protection officer named in section 1.

5. Who else can get anything

No individual record about you goes to an outside organisation for its own use. There are four exceptions:

• a study you have joined, under its own consent — what you fill in for it goes to its organiser as that consent says, and our own copy of the same answers stays here and follows your choices in section 6;
• our secure environment, described below;

• where the law compels us, described in section 9;

• the laboratory that tests a sample from a kit you ordered from us: it gets your name, contact details and order number for that order and nothing else, and it is named when you order.

Our suppliers handle data on our instructions and for nothing else. They are listed and kept current at www.oltair.ai. Where one is outside Europe we hold the paperwork European law requires and you can ask us for a copy.

Anonymous statistics. From all the data we also build group statistics from which no person can be recognised — how many users in a region sleep less than seven hours, for example. Such statistics are no longer your personal data and we may use, publish and supply them for any lawful purpose, including our own commercial communications and dealings with partners. Before we release them we check that they identify nobody, and we do not publish statistics about groups too small to keep people in them anonymous. Readings from your phone's health store do not enter them.

An organisation through which you have access. If an employer, club, university or other organisation gives you access to the app, it receives from us only the anonymous statistics described above. It receives your individual record only if you expressly agree to that when you link to it; you can withdraw that agreement at any time.

Research outputs. We turn health data into: group statistics, invented datasets that keep a group's patterns and match no real person, and statistical models, including data models and models for the use of artificial intelligence. We supply these for health research to universities, public bodies, hospitals and companies working in health or research, and to makers of products researching how what they sell affects health. We charge some organisations a fee for them. No individual record that would identify you is supplied. An output is released only after we have checked that it identifies nobody; one that does not pass is not released, and we do not publish statistics about groups too small to keep people in them anonymous.

The secure environment. Approved organisations' analysts sign in to our own system and work there. Your coded record stays inside it; no record comes out, only checked results. We control and monitor how the environment is used. Organisations pay for that access. Analysts can look at and compute over your coded individual record — even that anonymised record is still data about you and the law still protects it, which is why it is a separate choice.

Every organisation applies to our independent ethics committee, which decides by published rules; its decision, its reasons and the organisation's name go in a public register at www.oltair.ai before anything is supplied. Organisations that fund us or work with us apply like anyone else. Every one of them signs the same rules:

• use only for the health research it stated;
• nothing it receives may be used to advertise to, market to or profile any individual, or to decide anything about any individual's insurance, credit or employment;
• no attempt to identify anyone;
• no combining with data it already holds about individuals;
• no passing on of anything it receives, other than results it publishes under the research it stated.

Any breach ends its access.

If a discovery made this way earns money, you will not be paid.

6. Your choices

Tick what you agree to. Only the first is needed to create an account.

Run the app for me. I consent to OLTAIR using my health data to run the app for me, as listed in section 3, by whichever route it reaches OLTAIR. OLTAIR uses it to compute my indicators, run the assistant and prepare my summary.

Improve the app and develop other products. I consent to OLTAIR using my health data, with a code in place of my name, to test and improve the app and to develop new OLTAIR features, products and services, including training the models that run inside them. A trained reviewer may read my assistant conversations for this. Nothing built this way goes to anyone outside OLTAIR.

OLTAIR's own research. I consent to OLTAIR using my coded health data in its own research on health, lifestyle and performance. Its independent ethics committee approves each project and lists it publicly before it starts. Results are published without naming anyone.

Tell me about studies. I consent to OLTAIR telling me in the app about studies run by other organisations, and to OLTAIR checking my health data against a study's entry rules to decide whether to show me an invitation. OLTAIR tells the organiser nothing about me unless I join.

Research outputs. I consent to OLTAIR using my health data for health research: group statistics, invented datasets matching no real person, and statistical models, including models for use in machine learning and artificial intelligence, supplied to the organisations described in section 5, some of which pay for them. No individual record of mine is supplied.

The secure environment. I consent to organisations approved by OLTAIR's independent ethics committee looking at and computing over my coded health record inside OLTAIR's secure environment, for the health research each has stated. They pay for that access. No record of mine leaves the environment; only checked results do. Each organisation is named publicly before it starts and I can refuse any one of them in Settings.

Everything you tick can be unticked in Settings at any time. Unticking the first closes your account, described in section 7; refusing any of the last five changes nothing about the app.

7. How long we keep it, and how to leave

We keep your data while your account exists. Your readings stay however old they are, because seeing how your health and habits change over years is only possible if the early years are still there. You can delete any period yourself at any time.

Close your account and we delete your data within 30 days, and from our backups within 90. Records of orders, payments and complaints we keep for as long as the law requires. Two things outlast that: the record of what you agreed, for three years, so we can show what you chose and when; and anything a law makes us keep.

If you do not open the app and no readings arrive from your devices for three years, we write to you, and if we hear nothing in 90 days we close the account and delete your data as described above.

Turning any choice off stops that use from the moment we receive it. It does not undo what was already done, and it does not make it unlawful. Specifically:

• your records leave the copy used to improve the app, and models built afterwards are trained without you;
• you leave the research set, including any analysis still running, and your research copy is erased;
• your record leaves the output copy and anything not yet released is recomputed without you;
• access to your record in the secure environment stops, with the record removed without undue delay.

Results already published, statistics already released and results already taken out of the environment are not recalled — publication cannot be undone, and those outputs were released only after we checked that they identify nobody.

Closing your account here is not leaving a study, and leaving a study does not close your account. Closing the account deletes our copy of your answers; the copy the study's organiser holds is governed by that study's own documents, and you end your participation with the organiser.

Deleting the app is not leaving. It stops new data reaching us; your account and data stay until you close the account. Your choices follow your account, not your phone. Nothing you turn off makes the rest of the app worse.

8. What could go wrong

The main risk is that data about your health exists at all, and nobody can promise it will never be seen by the wrong person. A data breach is when someone sees or takes data without permission. If one happens and it puts you at serious risk, we will tell you.

Data with a code instead of your name is not anonymous. Someone with enough other information about you could work out which record is yours. We think the chance is very small, but it is not zero, and it grows as more data about you is linked together — which is why any organisation receiving anything from us is forbidden to combine it with what it already holds about individuals. What is true today may not be true later; methods improve, and we can require recipients not to try but cannot promise that no one ever will.

Research findings describe groups of people — an age, a region, a way of living. Findings about a group can be used to support unfair ideas about that group, even when nobody in it is identified.

Some questions are personal. We ask them because they often turn out to matter for health, and you can skip any of them. Seeing a reading may worry you and send you to a doctor, at your own cost, and what you find may be nothing. Other people who use your phone may see that you use OLTAIR.

9. Your rights, and when we must hand data over

You can:

• see what we hold, and correct anything wrong;
• delete your data;
• ask us to pause using it while a question is sorted out;
• object to the things we do for our own reasons;
• take your data with you as a document or a data file;
• ask which research projects used your data.

We answer within a month, or tell you why we need longer. We may need to check a request is really from you.

We hand data to authorities only on a court order, on a lawful inspection, or where a statute requires it. We tell you when this happens unless the law forbids it, and if it forbids it only for a period, we tell you once that period ends. We will oppose, narrow or refuse a request we think is too broad or improperly made.

10. The assistant

The assistant is software, not a person. It answers your questions and explains your indicators against your own history. It does not give medical advice and does not perform any medical diagnosis. No decision about you with a legal or similarly serious effect is made by software alone.

It keeps your conversations and what it learns about your preferences. You can read those, delete any of them, or reset it, which erases everything it holds. A person reads a conversation only for a purpose you agreed to in section 6, under a study you joined, if you send us feedback about it, or where the law compels us, described in section 9. Conversations are never in the secure environment. They are processed by ASSISTANT_PROVIDER.

11. Security, and if OLTAIR changes

Your data is held on servers in the European Union, encrypted while it travels and while it is stored, with health data kept apart from the data that identifies you. Access to health data is logged and reviewed, our support staff cannot see it, and we have our security tested independently. Nobody can promise perfect security and we do not.

A new purpose or a new kind of recipient means a new notice and a fresh question to you. We never change what an existing choice means and never turn anything on by default. Every version of this document is dated and kept, with changes marked, and we keep a copy of the version you agreed to alongside your record of what you chose.

If OLTAIR is sold or reorganised, whoever takes over must follow this document and your choices, and you are told before anything moves. If OLTAIR became insolvent, whoever handles its affairs is still bound by data protection law and your choices, and your rights continue against them.

From 2029, European law will require some data held by apps like this to be made available for approved public-interest uses through a state body. That law sets its own rules for data released that way; they apply to that route and not to anything described above.

Version 19.1 · DATE · OLTAIR Systems Czech s.r.o.