Privacy policy

Last updated: 21st October 2024

Introduction

Tucuvi Care S.L. is committed to protecting the privacy of individuals whose personal data it collects.This Privacy Policy applies when you access or use our websites, platforms, apps, and other services, including blogs, events, and newsletters, that reference or link to this Privacy Policy.

This policy may be supplemented by additional privacy notices, terms, or statements provided to you. The Tucuvi company that operates or manages the Service, as identified herein, is the primary controller of the personal information you provide to, or that is collected through, the Service.

Depending on our role in delivering the Service as outlined here, and the associated contractual terms and obligations, we may also act as a data processor of your personal information on behalf of the data controller.

This policy outlines the principles under which we process any personal data you provide to us or that we collect from you. Please review this policy carefully to understand our views and practices regarding your personal data and how we handle it.

Data Collection and Purpose of Use

Tucuvi processes personal data for the following purposes:

• To provide, activate, and manage your access to and use of the software.
• To improve and maintain the quality of our services.
• To ensure compliance with legal, regulatory, and contractual obligations.
• To manage the business relationship with our customers and suppliers.
• To process contact data in order to establish communication with those requesting information.

If you send us a CV, we will process the data for the purpose of considering you in potential recruitment.

We may also use our clients' data to send them commercial communications by electronic means, provided they have authorized us to do so. You can always opt out of receiving these communications.

We collect data only when necessary for these specified purposes, ensuring adherence to the principles of Purpose Limitation and Data Minimization.

Types of Data Collected

Tucuvi, an artificial intelligence tool based on voice technology, may collect the following personal data:

• Identifying personal data, such as the patient’s name, surname, contact telephone numbers, home addresses, and dates of birth.
• Personal health data, such as illnesses, mood, social circumstances, and other health-related information.
• Data related to our customers, suppliers, and employees, including:
  • Personal identification data
  • Professional personal data
  • Personal data for business transactions (e.g., current account details)

This does not include data where the individual’s identity has been removed (anonymized data).

Legal Basis for Processing

We process your personal data under the following legal grounds:

For EU residents: In accordance with GDPR Article 6, we process your data based on consent, the performance of a contract, or legitimate interests.

For U.S. residents: We process PHI in compliance with HIPAA’s Privacy Rule, ensuring minimum necessary use and disclosure.

Generally, consent is requested to provide the service, as it is a direct service. However, we usually provide the service through our clients, who are responsible for collecting your consent. We process the data of the recipients solely to provide the service to our clients.

In this context, we act as data processors for the health data processed by our platform, while the data controllers are the entities to which we provide the service.

Therefore, the processing of customer, supplier, user, and employee data is based on the performance of contracts.

We may also conduct completely anonymous analyses based on our legitimate interest. This data is used to improve Tucuvi’s service and customer care.For commercial communications, recruitment, and information requests, we base the processing on the consent of individuals who voluntarily provide us with their data for these purposes.

Disclosure of Data

We may disclose PII/PHI under the following conditions:


• To authorized third parties who support our operations (e.g., service providers, subcontractors), ensuring they comply with data protection laws.
• To comply with legal obligations, such as government requests or regulatory requirements.
• With your explicit consent for specific purposes not covered in this policy.


We do not sell, rent, or disclose your personal data to third parties for marketing purposes.

Your Rights

As a data subject, you have the following rights regarding your PII and PHI:

• Right to Access: You have the right to request access to the personal data we hold about you.
• Right to Rectification: You may request corrections to any inaccurate or incomplete data.
• Right to Erasure: You can request the deletion of your data when it is no longer necessary for the purposes for which it was collected.
• Right to Restrict Processing: You may request to limit how your data is processed.
• Right to Data Portability: You can request a copy of your data in a commonly used format.
• Right to Object: You may object to the processing of your data for certain purposes.
• Right to Withdraw Consent: If we rely on your consent to process your data, you have the right to withdraw that consent at any time.

To exercise these rights, please contact us using the information provided in the "Contact Us" section below.

Data Security

We take appropriate technical and organizational measures to safeguard your personal data, ensuring protection against unauthorized access, disclosure, alteration, or destruction. Our security measures include encryption, secure access controls, and regular monitoring of our systems to:

• Prevent unauthorized alteration, loss, and processing of data
• Guarantee the security, integrity, and confidentiality of the data

Retention and Destruction of Data

We retain personal data only as long as necessary to fulfill the purposes outlined in this policy or as required by law. When your data is no longer needed, we ensure its secure deletion or anonymization in accordance with our retention and destruction policy.

If you send us a CV, we will not retain it for more than one year.

International Transfers of Data

The data we collect will not be shared with third parties except to fulfill our contracts with customers, suppliers, and employees or to meet our legal obligations. As we operate in both the EU and U.S., your personal data will be retained in the region of its origin. We ensure that any transfers comply with GDPR requirements through appropriate safeguards, such as Standard Contractual Clauses (SCCs).

Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable regulations. Any updates will be posted on this page, and significant changes will be communicated to you via email or notification through our services.

Contact Us

If you have any questions, concerns, or requests regarding your personal data or this Privacy Policy, please contact us at:

Tucuvi Care S.L.
info@tucuvi.com
Calle Hermosilla, 48 – 1º D 28001 Madrid, Spain

Alternatively, you may contact our office in the United States:
Tucuvi Health Inc.
info@tucuvi.com
80 Broad Street, Suite 2103, 10004 New York, US

You may, at any time, revoke your consent where the processing is based on consent, and exercise the rights of access, opposition, rectification, deletion, limitation, and data portability.
You may also contact our Data Protection Officer.

In any communication, please specify the right you wish to exercise and include a copy of your ID or an equivalent document to verify your identity.

Finally, Tucuvi informs you that you have the right to lodge a complaint with the Spanish Data Protection Agency (www.aepd.es). However, Tucuvi strives to protect the personal data we process. For any questions related to personal data, please do not hesitate to consult us or send us your inquiries at info@tucuvi.com.