Shareguard Health Privacy Policy

V1.4

1. General

Hygiaso AG ("Hygiaso", "We", "Us", "Our") operate the shareguard mobile apps, the shareguard website (shareguard.health) and any associated linked sites and services which link to the Shareguard Terms & Conditions ("Terms"), individually or collectively the "Application".

This Privacy Policy describes how the Application collects, manages, uses, and shares your Personal Data (PD). Personal Data is defined in the Swiss Federal Data Protection Act (FDAP) and the General Data Protection Regulation (GDPR) as “any information relating to an identified or identifiable person”.

The Application is a smartphone-based application with which you as a private individual (Private User) can gain oversight over your health data, hold a copy, and self-determine what you share with whom and for what purposes. The Application also comprises a Web Application with which professionals in the health domain can interact in their professional capacity and/or on behalf of their entity (Professional Users), and exchange data with Private Users. Hygiaso AG (“We”, “Us”, “Our”) owns, develops, and operates the Application, to provide Our services to its Users (“You”, “Yours”).

As a Private User, your Personal Data is encrypted by the operating system of your device, and you hold your keys in your wallet on your mobile device. As a Professional User, we hold and manage Personal Data which you process according to current good practice standards in a database. Personal Data is encrypted at rest and end-to-end in transit.

The Application also requires some Personal Data unrelated to health, which is necessary to facilitate, notify, obtain, manage, or share your health data, such as payment details or technical data regarding your device, application ID or software version you use.

Hygiaso is committed to the privacy of our Private and Professional Users (collectively the Users). We strive to strengthen privacy and data protection and enable you to exercise your rights to your Personal Data.

We manage personal data in compliance with the Swiss Federal Data Protection Act (FDAP) and the General Data Protection Regulation (GDPR), giving you individual rights you can exercise through the Application. You can contact Us on data protection matters via dpo@shareguard.health.

With regard to Personal Health Data (PHD):

2. Scope and Applicability

This Policy applies to the processing of Personal Data with the Application. The mobile app is released in Switzerland only and we register only Swiss-based entities to use the Web App.

3. How We Process Your Personal Data

This is how we process your personal data, depending on the service we provide for you:

3.1 No Account, No Password

As a Private User, you do not need an account nor a password. You can access the Application with the authentication means you have selected on your mobile device. As a minimal standard, you must at least use a robust PIN code, fingerprint, or Face-ID to unlock your mobile device and protect your data and keys.

If you are a Professional User of a registered entity, that entity will maintain a register of its Users and associated User names. These User names must be unique but can be chosen arbitrarily (at least five characters or digits). We use public-private cryptography technology (FIDO2, also known as “passkeys”) to authenticate yourself. Passkeys are stored on your mobile device for you to access your entity’s data and functionalities using an authorized User name. When you authenticate yourself as a Professional User, you present your passkey as proof to your organization. You release your passkey with the same PIN, fingerprint, or Face-ID of your own mobile device.

3.2 Authenticate Other Parties

When you scan a shareguard QR code of another User you mutually exchange technical addresses (Decentralized Identifiers, DIDs) which enable a secure encrypted bilateral communication channel between just the two of you. Your DIDs and associated public and private keys and attributes are encrypted and stored on your personal device (as a Private User) or in a cloud vault (as a Professional User) for later re-use with that other User. It is you who authenticate another User as the person with whom you intend to share data prospectively, you can assign a contact name to that person under which you will be able to conveniently find that person in your contact list in the Application and re-use the receiver’s data for future exchanges. The contacts of a Private User are stored on the Private User’s device and the contacts of Professional Users are stored in the cloud to enable a shared contact list for your organization.

3.3 Message Data to Another User

You can share a file holding health data and/or a text message with any of the contacts you have authenticated. If and when you do this, that file is sent to the receiver end-to-end encrypted. If the receiver has also kept a record of yourself in their contact list, they then know the originator and can rely on the authenticity of the source of the data transferred. The cloud-based services to relay data from one User to the other have no access to any Personal Data of yours other than DIDs (a technical identifier of the sender and receiver device) and they have no means to access the actual encrypted content of that message or data which is transferred, nor what Private User is behind a DID.

You can configure to be notified of new messages received and/or updates on the use of the Application.

3.4 Store and Download Data Received

If you as a Private User or Professional User have received a message from another User (whether Private User or Professional User), you can view and/or download that file and text message.
If You access messages or data on your device or via a browser from abroad, personal data is transferred to your device wherever you are and you explicitly consent to such data being transferred x-borders to your current location and jurisdiction.
If you have enabled notifications, then data identifying the receiving device is sent to our notification service provider upon each notification and transmitted via a server near you. These notifications do not contain any personal data. Such notifications may be transferred x-borders and you explicitly consent to such transfer by enabling notifications.

4. Your Tasks and Processing Responsibility

The Application provides you with functionality to parameterize and initiate actions. It is your responsibility to ensure that any interaction of yours with the Application and any parameterization reflects what you actually intend to perform.

As a Private User, you are the data subject and you self-determine and are responsible for what Personal Health Data you process in the Application provided to you and what processing should take place, i.e., what services and functionality you use.

You are fully accountable for any erroneous User activity, misuse, or abuse of the Application or inconsistent with the Application’s Terms. It is your responsibility to correctly specify what you share with whom and for what purpose and for what events you want to be notified.

It is your responsibility as a sender of data to establish with the recipient of your data, what they are allowed or able to do or must do with your data.

If you are the receiver of data, it is your responsibility to process data received lawfully and as agreed with the sender. If you have received Personal Data, then it is your responsibility to also perform on any rights the data subject may have on the Personal Data you collected, whether the data subject executes their right through the Application or outside.

As a User, you are the Controller of any personal data that you collect or share, and you confirm your accountability to comply by applicable data protection laws and to perform on your legal obligations.

If you download any data from the Application you are the sole Controller of that data from then on and responsible for all related aspects.

5. Our Tasks and Processing Responsibility

As the Application provider and operator, We are responsible to process Personal Data as instructed by you, through the Application. We support you in meeting your obligations handling Personal Data. We maintain necessary records within our privacy by design remit and will inform you about our processing in support of your compliance obligations. We will notify you of any instruction, which we identify to be in conflict with data protection laws, and we will also notify any legitimate disclosure request we may receive to the extent we are permitted to do so. We are not accountable for sending Personal Data to the wrong recipient, nor for transferring the wrong data, if this was specified like this.

Where we hold Personal Data of you as a Private User, we are responsible to perform on any legitimate request you may have (the data subject) to execute your statutory rights to your own data.

6. Legitimacy of Personal Data Processing and Retention

The Application (Hygiaso) processes your personal data on different legal bases or justifications, depending on what type of personal data is being processed for what purposes.

Any personal data which is necessary to establish communication channels, facilitate, obtain, manage, or share data, unrelated to your health, such as e.g., your payment details, or device address, is necessary for the performance of our service to you.

As Users who engage in authenticating each other and data sharing you exchange DIDs with each other (and we transmit these). This is necessary to provide the authentication and transfer services which you requested. You decide how long you want to hold each other’s communication address, which either of you can delete at any time and thereby remove this communication channel.

We keep official documents to the extent required for as long as legally required for commercial records and transaction logs (not containing Personal Health Data), i.e., 10 years. We hold your Personal Health Data on the Application for how long you as a data subject want to retain your own data in the Application for your personal use.

When you decide to share your PHD with another person or organization using the service of the Application, then we process your personal data as a necessity to perform the service you request from Us using the Application.

Where applicable law provides, we also process certain personal data for legitimate interest purposes to manage the service we provide, we need to access technical device data, such as software and device versions, so we can well manage and improve our service to you.

7. Key Contacts and Roles

Controller and/or Processor (joint or separate as implied by the described responsibilities above)

Hygiaso AG (manufacturer of the Application)
Malzgasse 18
4052 Basel, Switzerland
Registered in the Basel-Stadt, CHE-340.712.953

Health Info Net AG (HIN) (authentication service for health professionals)
Seidenstrasse 4
8304 Wallisellen, Switzerland
Registered in Zürich, CHE-103.489.218

Microsoft Schweiz GmbH (Microsoft Switzerland Ltd Liab. Co) (encrypted storage for web appli-cation users and their keys, encrypted messages, as well as logs and backend cloud services)
The Circle 02
8058 Zürich, Switzerland
Registered in Zürich, CHE-110.088.994

Google Cloud EMEA Limited (notification service)
70 Sir John Rogerson’s Quay
Dublin 2, Ireland
Registered in Dublin, IE660412

Data Protection Officer

We will designate a Data Protection Officer (DPO) when we process PHD on a large scale. You can contact Us on shareguard data protection matters via dpo@shareguard.health.

Supervisory Authority

Federal Data Protection and Information Commissioner (FDPIC)
Feldweg 1
3003 Bern, Switzerland
Telephone: +41 58 462 43 95, Contact the FDPIC