Usage Policy

PRIMUMAI PRIVACY AND COOKIES POLICY

Effective Date: [01/01/2025]

PART 1 - GENERAL PRIVACY POLICY

1. About PrimumAi

2. Scope of this Policy

• Users of PrimumAi PMS: Healthcare providers, administrators, and staff.
• PatientsIndividuals whose data is managed through our PMS.
• VisitorsIndividuals whose data is managed through our PMS.

3. Data We Collect

• Names, job titles, professional affiliations.
• Email addresses, phone numbers, and other professional contact details.

• IP addresses, browser types, operating systems, device identifiers, and geolocation data.
• Login credentials and access logs for system security and auditing purposes.

• Information about interactions with our PMS, such as frequency of access, pages visited, and features used.

• Patient information, medical histories, diagnoses, treatment plans, and any data necessary for healthcare operations.

• Records of communications, including emails, chat logs, and support requests, for operational and legal purposes.

4. Purpose and Legal Basis for Processing

• To provide healthcare management services as agreed upon with healthcare providers.

• To meet obligations under EU laws, including healthcare and taxation regulations.

• To improve our services, ensure security, and prevent fraud, provided these interests do not override individual rights.

• For specific activities requiring explicit consent, such as marketing communications or certain types of data processing.

• To protect the vital interests of patients or other individuals in emergency scenarios.

5. Data Collection Methods

• Users providing data via account creation, customer support, or system usage.

• Cookies, server logs, and usage tracking to optimise performance and identify system issues.

• External service providers such as AWS Analytics for performance and analytics data.

6. Data Sharing and Subprocessors

• AWS Ireland Limited
• Microsoft Ireland Operations Limited

• Subprocessors operate under Data Processing Agreements (DPAs) to ensure equivalent data protection standards.
• Shared data is minimised to the necessary scope and is encrypted to prevent unauthorised access.

7. Data Transfers Outside the EU

• We transfer data only to countries approved by the European Commission as having adequate data protection standards.

• For transfers to non-adequate countries, we implement SCCs to ensure GDPR-compliant protections.

8. Security Measures

• Data is encrypted at rest and in transit using AES-256 encryption protocols.

• Role-based access (RBAC) ensures that only authorised personnel can access sensitive data.
• Multi-factor authentication (MFA) adds an extra layer of protection.

• Continuous system monitoring and regular audits help identify and mitigate potential security risks.

• In the event of a data breach, we will notify affected parties and the Data Protection Commission (DPC) within 72 hours, as required by GDPR.

9. Data Retention

• Patient Data: Retained for 14 days after termination of the healthcare provider’s contract unless otherwise required by law.
• Usage Data: Retained for the duration of the contract and archived for analysis or legal compliance, as necessary.
• Technical Logs: Stored for up to 12 months for auditing and security purposes.

10. User Rights Under GDPR

• A. Right to Access: Users can request a copy of their personal data.
• B. Right to Rectification: Users can request corrections to inaccurate or incomplete data.
• C. Right to Erasure: Users can request deletion of data when it is no longer necessary or when processing is based solely on consent.
• D. Right to Restriction: Users can request limited processing in specific cases, such as data disputes.
• E. Right to Data Portability: Users can request their data in a structured, machine-readable format.
• F. Right to Object: Users can object to data processing for marketing purposes or other legitimate interests.

11. Data Subject Requests Procedure

• 1. Identity Verification: Ensure that the requester is authorized to access the data.
• 2. Assessment: Evaluate the request to determine its validity under GDPR.
• 3. Action and Notification: Take necessary action (e.g., data correction, erasure) and notify the requester of completion.

12. Complaints and Dispute Resolution

• Data Protection Commission (DPC)
• 21 Fitzwilliam Square South
• Dublin 2, D02 RD28, Ireland
• Website: https://www.dataprotection.ie

PART 2 - DATA SHARING, COOKIES, AND LEGAL FRAMEWORK

1. Data Sharing and Disclosure

• AWS Ireland Limited – Compliance: AWS is GDPR-compliant and operates under a Data Processing Agreement (DPA).
• Microsoft Ireland Operations Limited – Compliance: Microsoft adheres to GDPR and provides Standard Contractual Clauses (SCCs) for international data transfers.

2. International Data Transfers

• Adequacy Decisions: Data is transferred only to countries recognised by the European Commission as having adequate data protection laws.
• Standard Contractual Clauses (SCCs): Where adequacy decisions are not applicable, SCCs are used to maintain GDPR-equivalent protections.
• Encryption Standards: All transferred data is encrypted during transit to prevent unauthorised access.

3. Cookies and Tracking Technologies

• Essential Cookies: Required for the basic operation of our PMS, including secure login and session management.
• Performance Cookies: Collect anonymized data on how users interact with the PMS to identify areas for improvement.
• Preference Cookies: Store user settings such as language preferences to provide a tailored experience.

• Cookie Banner: When users access our website or PMS for the first time, a banner informs them of our cookie practices and allows them to manage preferences.
• Browser Settings: Users can adjust cookie permissions via their browser settings. This may, however, affect the functionality of certain PMS features.

4. Security and Data Breach Response

• Encryption: All data is encrypted using industry-standard AES-256 encryption at rest and TLS 1.2 for data in transit.
• Access Control: Role-based access controls (RBAC) ensure that only authorized personnel can access sensitive data.
• Firewalls and Intrusion Detection: Multi-layered firewalls and real-time intrusion detection systems monitor for potential threats.
• Regular Penetration Testing: Audits are conducted annually to identify and mitigate vulnerabilities.

• 1. Incident Detection: Security monitoring tools detect unusual activities or breaches.
• 2. Immediate Action: Contain and mitigate the breach to minimise its impact.
• 3. Notification: Notify affected users and the Data Protection Commission (DPC) within 72 hours, as mandated by GDPR.
• 4. Investigation and Reporting: Conduct a detailed investigation and provide a full report to the DPC and affected users, outlining the breach’s scope, cause, and mitigation measures.

5. User Rights and Support

• Access: Request access to their data and information on how it is processed.
• Correction: Request corrections to inaccurate or incomplete data.
• Erasure: Request deletion of their data (“right to be forgotten”) under specific conditions.
• Restriction: Request restriction of processing when data accuracy or legality is contested.
• Portability: Request a copy of their data in a structured, machine-readable format.
• Objection: Object to data processing for direct marketing or legitimate interests.
• Withdraw Consent: Where data processing is based on consent, users may withdraw this consent at any time.

6. Accountability and Audit Framework

• Internal Audits: Conducted quarterly to ensure all data processing activities align with GDPR requirements.
• External Assessments: Independent third-party audits are performed annually to verify compliance.

• Categories of processed data: Detailed documentation of all data types processed.
• Data retention schedules: Timelines for how long different categories of data are kept.
• Subprocessor agreements and safeguards: Agreements with subprocessors outlining their obligations and safeguards for data protection.

• Data protection principles: Fundamental concepts of data privacy and protection.
• Incident response protocols: Procedures for responding to and managing data breaches or security incidents.
• Secure handling of sensitive information: Best practices for ensuring the confidentiality and integrity of personal data.

7. Legal Disclosures and Protections

• Regulatory Compliance: Data may be disclosed to the Data Protection Commission (DPC) or other legal authorities upon request.
• Legal Defense: In the event of a legal dispute, PrimumAi may disclose data as necessary to defend against claims or protect the rights of the company.

Liability Limitation

8. Complaints and Resolution

• 21 Fitzwilliam Square South
• Dublin 2, D02 RD28, Ireland
• Website: https://www.dataprotection.ie

PART 3 - OPERATIONAL POLICIES, RISK MANAGEMENT, AND COMPLIANCE MONITORING

1. Operational Policies

• Role-Based Access Control (RBAC): Access to personal data is restricted based on job roles and responsibilities.
• Multi-Factor Authentication (MFA): All employees and contractors must use MFA for accessing the PMS and sensitive systems.
• Access Auditing: Regular reviews of access logs to identify unauthorized or unusual activity.

• Data Minimization: Only collect and process data necessary for specific, legitimate purposes.
• Secure Transfers: Use encrypted channels (TLS 1.2 or higher) for data transfer.
• Data Anonymization: Anonymize data whenever possible to reduce privacy risks, particularly for analytics and reporting purposes.

• Retention Schedules: Define specific retention periods for all categories of data:
• Patient records: Retained for 14 days post-contract termination unless otherwise required.
• System logs: Retained for up to 12 months for auditing and troubleshooting.
• Secure Disposal: Implement secure deletion protocols, such as data wiping for data at the end of its lifecycle.

2. Risk Management Framework

• Quarterly Risk Assessments: Conduct regular assessments to identify potential vulnerabilities in data handling, storage, and processing.
• Data Protection Impact Assessments (DPIAs): Required for any new processing activities involving sensitive data to evaluate their impact on data subjects’ rights.

• Incident Response Plans
• Employee Training
• Regular Penetration Testing

• Business Continuity Plan (BCP): Ensures critical PMS operations continue during disruptions.
• Data Recovery Protocols: Regular backups of sensitive data to secure locations, with recovery testing conducted quarterly.

3. Compliance Monitoring

• Frequency: Quarterly audits are conducted by the Data Protection Officer (DPO) to review compliance with GDPR principles.
• Scope:
  • Review of access logs and permissions.
  • Assessment of subprocessors’ compliance.
  • Analysis of retention schedules and deletion protocols.
• Documentation: Detailed records of all audits are maintained for regulatory review.

• Annual Audits: Third-party audits are conducted to ensure independent verification of PrimumAi’s GDPR compliance.
• Focus Areas:
  • Data security and encryption practices.
  • Subprocessor agreements and safeguards.
  • Incident response readiness.

4. Employee Responsibilities

• Data Protection Officer (DPO): Oversees data privacy practices, manages data subject requests, and liaises with regulatory authorities.
• Compliance Manager: Ensures all operational processes align with GDPR and monitors adherence to internal policies.
• IT and Security Team: Implements technical safeguards and responds to security incidents.

• Onboarding Training: All new employees must complete GDPR and data security training within their first month.
• Ongoing Education: Annual refresher courses on data privacy and secure data handling are mandatory for all staff.

5. Accountability and Documentation

• Maintained as required by Article 30 of GDPR.
• Includes:
  • Categories of personal data processed.
  • Data flows and transfer mechanisms.
  • Retention schedules and deletion procedures.

• Data Processing Agreements (DPAs): Detailed agreements with all subprocessors outlining their GDPR compliance obligations.
• Regular Reviews: Annual reviews of sub-processor compliance, including audits and certifications.

• Incident Logs: Comprehensive records of all breaches, including cause, resolution, and preventive measures.
• Regulatory Submissions: Breach notifications sent to the Data Protection Commission (DPC) are documented for reference.

6. Data Subject Rights Management

• Access Requests: Users can request information on how their data is processed and a copy of their personal data.
• Correction Requests: Data subjects can request updates to inaccurate or incomplete data.
• Deletion Requests: Users can request erasure of their data in cases where processing is no longer necessary or lawful.
• Restriction and Objection: Data subjects can limit data processing or object to processing for legitimate interests or direct marketing.

1. Submission: Data subjects submit requests via email to harsh@primumai.eu.
2. Identity Verification: Requesters’ identities are verified to prevent unauthorized access.
3. Processing: Requests are processed within 30 days, with extensions for complex cases.
4. Notification: Users are informed of the outcome and actions taken.

7. Supervisory Authority and Complaints

• Data Protection Commission (DPC)
• 21 Fitzwilliam Square South
• Dublin 2, D02 RD28, Ireland
• Website: https://www.dataprotection.ie

8. Policy Review and Updates

• Major updates are implemented annually.
• Interim updates are made as necessary to address changes in regulations, technologies, or subprocessors.