Scope of this Privacy Notice
Biogen, Inc. of 225 Binney Street, Cambridge, MA 02142, USA (“Biogen”) has developed Cleo to provide support to individuals living with Multiple Sclerosis (MS). This Privacy Notice describes what “personal data” (meaning any information relating to an identified or identifiable natural person) we need to collect from you in the app, how we use it and why, and your rights in relation to this collection and use. You are under no obligation to provide personal data to us, but should you decide not to, you will not be able to use the app as it requires certain basic personal data to function, as described below. If you wish to continue, please read the following information carefully and provide your consent by ticking the relevant tick box in the app.
Information we collect and how we use it
The different features of the app collect different types of personal data depending on your use of these features.
App registration. If you choose to use the app, you will need to create an account and user profile within the app. We will collect the following necessary personal data from you to do this: your name; e-mail address; password; country in which you live; the date you registered to use the app; and topics of interest to you regarding MS. We will then assign you with a unique app user registration number. If you choose to provide it, we may also collect the following personal data from you: gender; date of birth; month and year of MS diagnosis; and type of MS. We require this information to: (a) create and manage your account; (b) tailor your user experience and provide you with information that matches your personal profile and preferences; and (c) provide you with local technical and administrative support, where necessary.
MS journal. If you use the journal feature of the app, this allows you to have a full picture of your MS and will involve your recording health information concerning your MS (such as mood, symptoms, fitness and physical activity) and medical history (including whether/when you were diagnosed with MS, type of diagnosis, treatment and medication). The journal also allows you to manage your medical appointments and remind you to take your medication in a compliant way. It can also send you push notifications to remind you of events connected with your MS, if you chose to activate this functionality. It is up to you whether you set up and use the journal and you decide what information you enter into it.
Reports. The app allows you to generate reports based on your journal that can be shared, e.g. with your doctor. This feature allows you to select the information that is provided in your report as well as the date range for that information. Your report will be generated in PDF format and can be shared outside of the app, by whichever means you decide, using the methods made available to you by your device, e.g. e-mail, text message or WhatsApp message.
Cleo Chat service. Your personal data mentioned in the “App registration” paragraph above will be accessed by a trained Cleo Advisor if you choose to use the live chat service. This will allow the adviser to chat with you effectively and to provide you with information and advice about Cleo. Biogen may also use the information you have provided in your chat when: (a) it is necessary in submitting complaint or adverse event reports to local and international health or pharmaceutical regulators and as otherwise required of us by law (please see the “How we share your information and international transfers” section below); (b) to investigate a complaint made by you about the live chat service; (c) to investigate or resolve a technical problem; and (d) for monitoring and training purposes.
Apple Health or Google Fit app interaction. If you choose to activate this feature, we may collect the following categories of personal data from the relevant app to which you subscribe: activities; mindfulness; nutrition; body measurements; health records; and sleep. This feature is linked to the content that you have provided in your Apple Health or Google Fit app and you will be asked which categories of information you would like to be shared with our app. If you have not recorded any information in your Apple Health of Google Fit app, you will be unable to use this feature. This information is shared via an app interface technology that uses a piece of code enabling it to: (a) verify that you have activated this feature; and (b) send a request for information to your Apple health or Google Fit app. Biogen may share such personal data with an MS nurse if you choose to use the live nurse chat service. We will not share your personal data in the app with your Apple Health or Google Fit app.
Information materials on MS. The app gives you access to articles and videos on MS. Your personal data mentioned in the “App registration” paragraph above will be used to personalise some of this content.
Programmes. The app gives you access to certain programmes and videos designed to improve your health and fitness. If you choose to use this feature, please consult with your physician and or physiotherapist before starting any of these exercises. These exercises are for illustration purposes only. If you feel pain or discomfort at any time do stop and seek your physician's advice. We will collect personal data from you, including: what videos you have seen; your rating of any videos you have seen; what programmes you have completed; and when you have completed them. We require this information to: (a) provide you with videos or programmes that match your profile and preferences; (b) manage the content of the videos or programmes that we provide; (c) request your feedback on a video or programme; (d) send you a congratulatory message when you have completed a programme; and (d) send you a reminder to complete a programme that you have not yet finished.
Marketing materials. If you provide your consent by ticking the relevant tick box in the app, Biogen and its affiliated companies will use your personal data to send you direct marketing communications (insights about MS, clinical trial information, patient education materials and invitations to participate in market research surveys). You may unsubscribe from receiving such communications at any time and you may also manage your preferences in the app.
Use of analytics technologies. If you choose to use the various features of the app mentioned above, we may automatically collect the following personal data from you to assess how you are using the app, where this is permitted by your device settings:
(a) technical information, including your IP address, your login information, browser type and version, device identifier, location and time zone setting, browser plug-in types and versions, operating system and platform, page response times and download errors; and
(b) information about your visit, including what features of the app you use and how frequently you use them.
This data collection technology allows us to personalise your experience, to enhance this app and your experience when you use it, and to send you push notifications if you have selected to receive them. We work with partners who act as our data processors to provide us with analytics and manage our online advertising programme. Biogen and our data processors may use the technologies to track the actions of users of the app, to measure statistics of our marketing efforts, to help foster the use of the app by other individuals needing its support and to inform them about the app and to deliver advertisements on third party websites. Cookies and similar technologies may be used to collect this information, such as your interactions with the app.
We may also engage service providers to assist in fostering the use of the app by other individuals needing its support and to inform them about the app, however no health data is shared by Biogen in this context.
We support the Self-Regulatory Principles for Online Behavioral Advertising of the Digital Advertising Alliance. This means that we allow you to exercise choice regarding the collection of information about your online activities over time and across third-party websites for online interest-based advertising purposes. More information about these principles can be found at www.aboutads.info. If you want to “opt out” of receiving online interest-based advertisements, please follow the instructions at www.aboutads.info/choices or www.networkadvertising.org/choices. An “opt-out” cookie will be placed on your device indicating that you do not want to receive interest-based advertisements. If you delete cookies on your device generally, you will need to opt-out again. Please note that when you “opt-out” of receiving interest-based advertisements, this does not mean you will no longer see advertisements from us. It means that the online ads that you do see will not be based on your interests. When you “opt-out” of receiving interest-based advertisements through one of the links above, these data collection technologies may still collect information about your use of the websites, including for analytics.
How we share your information and international transfers
Service providers. Biogen engages service providers to assist it in the administration of its data processing activities in relation to the app (known as “data processors”). These include the companies which: (a) provide Biogen with local MS nurses as part of the live nurse chat service; (b) provide the technology solution to be used for the live nurse chat service; (c) host the app and your personal data in the cloud and provide Biogen with data storage facilities; (d) provide the analytics technologies mentioned above.
Other Biogen companies. Biogen may also share your personal data with other companies in the Biogen group for the purposes described in this Privacy Notice including Biogen International GmbH, Landis & Gyr-Strasse 3, 6300 Zug, Switzerland and the local Biogen affiliate in your country. If a third party acquires all or part of Biogen's business or assets, then your personal data may be disclosed in connection with that sale.
Pharmacovigilance and regulatory requirements. Biogen is obliged by law to comply with regulatory requirements applicable to it as a pharmaceutical company, including the reporting of adverse reactions to its products to monitor the safety of all medicines that we market (also known as our pharmacovigilance or adverse event reporting obligations). Biogen may collect, use and disclose your personal data to other members of the Biogen group and other third parties where it considers this necessary for compliance with applicable laws, to protect the vital interests of Biogen or any other person, or where necessary to exercise, establish or defend Biogen's legal rights.
Ensuring protection of your data. The transfers mentioned above may include transfers outside of your country to countries outside the European Economic Area (EEA). Biogen takes appropriate steps to ensure your data is adequately protected if transferred to such countries. For example, Switzerland is a country deemed to provide an adequate level of data protection under its data protection laws by the European Commission. Biogen otherwise has EU-approved standard contractual clauses, or equivalent measures, in place where necessary to provide an adequate level of data protection. Upon your request, Biogen will provide you with a list of all recipients of your personal data and/or further information on any data transfer agreements with recipients outside the EEA.
How we store your personal data
We will only retain your personal data for as long as it is necessary for the purpose for which that data was collected and to the extent permitted by applicable laws. When we no longer need to use your personal data, we will remove it from our systems and records and/or take steps to anonymise it so that you can no longer be identified from it (unless we need to keep your personal data to comply with legal or regulatory obligations to which we are subject).
Giving and withdrawing your consent
Because our app is designed for patients of MS, we process your health-data from the moment you register and begin to use the app. We therefore require your explicit consent for this data processing under data protection law, as set out in detail under this Privacy Notice. You give your consent by ticking the box in the registration process. You may withdraw your consent by using the “Contact Us” feature within the app. If you withdraw your consent we will delete your account and you will no longer be able to use the app.
You also have the choice to consent to receive e-mails which may be of interest to you, as set out under the “marketing materials” paragraph above. It is your decision whether you provide your consent. If you do not consent you may still use the app, but this means you will not be able to receive such e-mails. You may withdraw your consent to this in the app settings. Withdrawing your consent means we will no longer send you such e-mails.
You may contact Biogen at any time to exercise the following rights under data protection law:
• access and receive your personal data or require information about the personal data that we hold about you;
• ask us to restrict our processing of your personal data or you object to our processing;
• ask for your personal data to be provided on a portable basis; and
• ask us to correct or erase information we hold about you.
• withdraw consent at any time
Please note that some of these rights are limited by applicable data protection law and we have the right to collect, process and hold your personal data to perform our legal obligations. You may, should you feel it necessary, lodge a complaint with your local data protection authority if you feel your privacy rights have been infringed.
The app is not designed for use by anyone under the age of 18. We do not knowingly make the app available to, or collect personal data from, children under this age. In case we discover that a child under 18 has downloaded the app and provided us with personal data, we immediately delete this from our servers and block access to the app. If you are a parent or guardian and you are aware that your child has provided us with personal data, please contact us so that we can take the necessary action.
Under European data protection Law, a "data controller" is the legal entity that is responsible for protecting your personal data and helping you to exercise your data protection rights. The data controller of your personal data is Biogen, Inc. and its EU data protection representative is its affiliated company Biogen GmbH of Carl-Zeiss-Ring 6, 85737 Ismaning, Germany. If, at any time, you have questions or concerns about this Privacy Notice or the processing of your personal data, you can contact Biogen by using the “Contact Us” feature within the app. You may contact Biogen’s Data Protection Officer at firstname.lastname@example.org.
Date of Prep Feb 2019 Biogen-03173
Your data will be securely stored and protected.