SCRIPT – END USER PRIVACY POLICY

1. INTRODUCTION

Welcome to Super App Ltd’s privacy notice (the “Notice”).

Super App Ltd (C 101360) of 125, Triq Anici, Qormi, Malta (“Script”, “we”; “us”; “our”) respects your privacy and is committed to protecting your personal data.

We have launched a digital application which enables registered users (whom we term “End-Users”) to request and receive electronic prescriptions (“e-prescriptions”) from medical professionals who have signed up with us (whom we term our “Partners”) and, as an additional service, to request and schedule medical appointments with Partners subject to their availability and acceptance (collectively, the “Services”).

This app is named “Script” (the “App”) and is operated by us (Super Apps Ltd) to make accessible and provide those Services to our registered End-Users and Partners.

The purpose of this Notice is to set out the basis on which we will process your personal data as a user when you:

• visit and use our App as a user (regardless of where you visit or use it from);
• apply for and open an account with us as an End-User (your “End-User Account”); and
• apply for, receive or use any of the Services that we offer to our End-Users through the App.

This includes any data that you may provide for and in relation to our newsletters, updates, events and other marketing and promotional communications.

This Notice explains what personal data we collect about our End-Users, how and why we collect that data and the ways in which we may disclose it and our reasons for doing so. It also provides information on how to exercise your rights as a data subject in relation to your personal data (see Section 11 – “your legal rights”).

This Notice should be read in conjunction with our End-User Terms and Conditions. We may revise this Notice from time to time, but we will never do so in a manner that undermines your rights. We will provide notice through the App when we make any material modifications to this Notice and strongly encourage you to review any changes made. We also have a separate privacy notice and applicable terms and conditions for our registered Partners.

2. INFORMATION ABOUT SCRIPT

Through the App, SCRIPT provides a digital platform that connects End-Users and Partners. SCRIPT’s technology permits End-Users to make use of the Services available to them via the App, which includes the ability to (following a request made to the relevant Partner) receive e-prescriptions and schedule medical appointments. The terms and conditions on which SCRIPT provides or makes available these Services to End-Users can be accessed here.

It is important that you read this Notice together with any other privacy notice or statement we may provide on specific occasions when we are collecting or processing personal data about you so that you are fully aware of how and why we are using your personal data.  This Notice supplements the other notices and is not intended to override them.

Controller

SCRIPT is the operator of the App and is also the controller and responsible for your personal data in accordance with the General Data Protection Regulation (“GDPR”) and Maltese data protection laws.

If you have any questions or requests, including any requests to exercise your legal rights as a data subject, please contact us using the details set out below:

Contact Details

Full name of legal entity:            Super App Ltd (C 101360)

Email address:                          info@script.mt

Postal address:                         125, Triq Anici, Qormi, Malta

Third-Party Links

The App may include links to third-party websites, plug-ins and applications, whose practices may differ from our own. Clicking on those links or otherwise enabling those connections may allow such third parties to collect or share personal data about you. We do not control these third-party websites or applications and we are not in any way responsible for their privacy notices, statements or practices. We encourage you to carefully read the privacy notice, privacy statement and other policy of any website or application you visit, access or use.

Minors

Neither the App nor Services are directed at minors, and we do not knowingly collect information relating to minors.

If you are a parent or guardian and you are aware that that your child (being a minor) has provided us with personal data without your consent, you may contact us at info@script.mt.

If we learn that we have collected a minor’s personal data in violation of applicable law, we will promptly take steps to investigate this, delete such information and, where applicable, terminate the minor’s account.

Your Duty to Inform Us of Changes

It is imperative that the personal data we hold about you is accurate and current at all times. Otherwise, this will prevent us from being able to properly administer your End-User Account or provide you with the Services (amongst other potential issues). Please keep us informed if your personal data changes during your relationship with us.

3. SOME KEY DEFINITIONS

Set out below are key definitions of certain data protection terms which appear in and apply to this Notice:

• “data subjects” means living, natural persons about whom we process personal data;
• “data controller” or “controller” means any entity or individual who determines the purposes for which, and the manner in which, any personal data is processed;
• “data processor” or “processor” means any entity or individual that processes data on our behalf and on our instructions (we being the data controller);
• “GDPR” means the General Data Protection Regulation (Regulation (EU) 2016/679);
• “legitimate interest” means our interest to conduct and manage our business appropriately and responsibly, to protect the reputation of our business, and to provide the best possible services. We make sure we consider and balance any potential impact on you (both positive and negative) and your rights before we process your personal data for our legitimate interests;
• “personal data” means data relating to a living individual (i.e., natural person) who can be identified from the data we possess about him or her. This includes, but is not limited to, your name and surname, address, date of birth, contact details. It does not include information relating to a legal person (such as a company);
• “processing” means any activity or set of operations that involves use of personal data. It includes obtaining, recording or holding the data, or carrying out any operation or set of operations on the data including, organising, amending, retrieving, using, disclosing, erasing or destroying it. Processing also includes transferring personal data to third parties; and
• “sensitive personal data” includes information about a person’s racial or ethnic origin, political opinions, religious, philosophical, or similar beliefs, trade union membership, physical or mental health or condition or sexual life or his or her biometric data.

4. THE PERSONAL DATA WE COLLECT ABOUT YOU

Personal data means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).

In the course of your relationship with us (including during the account opening stage), we may collect, use, store and transfer different kinds of personal data which we have grouped together as follows:

• Identity Data: includes your first name, surname, title, gender, address, and account details (including your username). This data will form part of your End-User Account information on the App; 
• Contact Data: includes your email address and other contact details which you supply; 
• Payment Data: includes details about your payments made through the App;
• Service Data: includes your Payment Data and details about your use of the Services as an End-Users. Particularly, this category also includes details about your e-prescriptions and appointments from the Services, which will in practice involve processing sensitive personal data about the End-User (namely in the form of health data). The specific basis on which we process this health data is explained further below);
• Technical Data: includes the IP address, your login data to the App (username and password), device type, browser type and version, time zone setting and location, browser plug-in types and versions, operating system, and other technology on the devices you use to access the App;
• Usage Data: includes information about how you use the App and the Services as an End-User; and
• Marketing Data: includes your preferences in receiving marketing from us and our third parties and your communication preferences.

We also collect, use and share data in an aggregated form such as statistical or demographic data to improve the App and for statistical and benchmarking purposes, including enabling comparisons within the same industry to enhance the insights collected through the App.  Aggregated Data could be derived from your personal data but will not be considered personal data in law as it will not directly or indirectly reveal your identity. For example, we may aggregate your Usage Data to calculate the percentage of users accessing a specific website feature. However, if we combine or connect Aggregated Data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this privacy policy.

If you Fail to provide Personal Data

Where we need to collect personal data about you:

• by law; or
• under the terms of, or in connection with, the contract that we have with you (as discussed above); or
• as part of our legitimate interests to protect the reputation of our business and mitigate against risks;

and you either fail to provide that data when requested, or else provide incomplete or insufficient data, we may not be able to perform or conclude the contract that we have or are trying to enter into with you. This may include having to refuse your registration as an End-User or closure of your End-User Account.

Special Categories of Personal Data

We collect and process health data about End-Users as a necessary component of the Services. In practice, as an End-User, health data relating to you could be included in your e-prescriptions or appointment information (e.g., where inputted by the Partner) or, alternatively, it could be possible for us to derive information about your health status, including any conditions, from your Service Data. We process and store this health data on the App with all due safeguards in place and keep it available for you and your medical provider (who must be a registered Partner) to be able to use and consult as part of your medical treatment and history. Other than health data from the Services, we do not process any other special categories of personal data about End-Users.

We process this health data based upon your explicit consent, which we request from you at the outset when setting-up and registering your End-User Account. You are not bound to give your consent and may also withdraw it at any time as explained below at section 11 (“your legal rights”), but please be aware that doing so will mean that your health data cannot at law be transmitted or otherwise processed over the App and consequently, it would not be possible for us to provide the requested Services to you due to applicable data protection laws.

On this, we do however wish to underline and re-assure that the use of App and its services is entirely voluntarily and are being provided to End-Users by Script as an alternative, and not as a replacement, to existing practices for requesting and receiving medical prescriptions (e.g., by direct requests in writing to the medical provider), or arranging and fixing medical appointments (e.g., by calling or emailing the relevant clinic directly), or any other matter incorporated into the Services. The App is only intended to serve as a digital alternative to such existing practices, but in no circumstance will refusing or else withdrawing your consent prevent you from being to obtain physical prescriptions or using such prescriptions or scheduling medical appointments through other channels.

All of this is reiterated and explained further in the consent form which we present to you.

In some cases, we may also have grounds to use your Health Data to protect your vital interests in the case of an emergency or where a dispute arises between you and use and we need to use your Health Data for that dispute.

5. HOW IS YOUR PERSONAL DATA COLLECTED?

(A)   Account Registration and Opening.

We will ask you to provide your Identity and Contact Data when you apply to register and open an account with us as an End-User on the App. You provide these personal details to us, which we collect and process, when you fill in and submit our online form (together with other related forms) and complete other required steps for your account.

Your account information, Payment Data and Service Data will then be generated based on your registration and use of the App and its services. We will also process this information in the course of your relationship with us.

(B)   Service Use

This may encompass all of the data categories listed in section 4, particularly Identity, Usage and Service Data.

(C)       Direct Interactions.

You may also give us your Identity, Contact, Payment and Service Data by filling in our other forms (i.e. separate to our account opening and registration form), or by corresponding with us by post, phone, e-mail or otherwise.

This includes personal data that you provide when you, as applicable:

• apply to create and register an End-User Account;
• request and/or receive the Services;
• update or edit your account details;
• contact us with complaints or queries;
• report issues;
• request marketing to be sent to you;
• participate in a survey; or
• provide us with feedback.

(E)        Third Parties or Publicly Available Sources.

We may receive personal data about you from various third parties and public sources, as set out below:

• Technical Data from the following parties:
• analytic providers such as Google Analytics;
• advertising networks such as Facebook;
• search information providers such as Google Ads.

Other sources may include:

• anti-fraud databases and other third-party databases;
• debt collection and credit reference agencies and fraud detection agencies;
• publicly available sources, such as the electoral register.

6. HOW WE USE YOUR PERSONAL DATA

We have set out below, in a table format, a description of all the ways we plan to use your personal data, and which of the legal bases we rely upon to do so. We have also identified what our legitimate interests are where appropriate.

Note that we may process your personal data pursuant to more than one lawful ground or basis, depending on the specific purpose for which we are using your data.

Please contact us at info@script.mt if you need details about the specific legal grounds we are relying on to process your personal data where more than one ground has been set out in the table below.

Marketing

You may receive marketing communications from us (which may consist of newsletters, industry updates, mailshots, publications, promotional materials and/or information about our events) where:

• you have an ongoing relationship with us (e.g., a registered end-user); OR
• (in the absence of a relationship), you consent to receiving such marketing communications;

AND

• provided you have not unsubscribed to receiving marketing from us (see your right to object below).

THIRD-PARTY MARKETING

We will get your express opt-in consent before we share your personal data with any third parties (including any associated or affiliated entities) for marketing purposes. Health Data will not be shared for marketing activities.

Opting Out

You can ask us to stop sending such advertising and marketing communications at any time by:

• following the opt-out links on any marketing message sent to you;
• contacting us at any time at info@script.mt.

Change of Purpose

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose, or we are obliged to process your data by applicable laws or court or other enforceable orders.

If you wish to get an explanation as to how the processing for the new purpose is compatible with the original purpose, please contact us at info@script.mt.

If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

7. DISCLOSURES OF YOUR PERSONAL DATA

We may need to share your personal data with third parties for the purpose set out above.

Information we may share to other parties:

• external third-party consultants, (sub-)contractors, suppliers or other service providers who may access your data when providing services to us (including but not limited to IT support services). This includes information technology experts who design and host the App, and general service companies. These are carefully selected to ensure that they meet high data protection and security standards. We only share data with them that is required for the services offered and we contractually bind them to keep any information we share with them as confidential and to process personal data only according to our instructions;
• auditors or other advisors auditing, assisting with or advising on any of our business purposes;
• our successors in title or third parties to whom we may choose to sell, transfer, or merge parts of our business or assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, the new owners may use your data in the same way as set out in this Notice; or
• government bodies and law enforcement agencies and in response to other legal and regulatory requests or by instruction from a court, tribunal or public authority.

Where your details are provided to any other party in accordance with an express purpose, we will require them to be kept safe and secure your personal data and only use it for the intended purpose.

Furthermore, we may also disclose your data to enforce our contractual terms against you, or to protect our rights, property or safety, and that of other users of the App. This includes exchanging information with other companies and organisations for the purposes of fraud protection.

Joint Controllership

Where you engage the services of a Partner through the App (such as for prescriptions), that Partner and Script, as the operator of the App, act as a joint controller of your personal data within the meaning of article 26, GDPR. For that purpose, we have concluded a joint controller arrangement, which is incorporated into the Partner Agreement.

This arrangement defines the specific duties, rights and responsibilities of Script and the individual Partner in their joint processing of your personal data. Set out below are how some of these responsibilities have been allocated:

• SCRIPT is responsible for providing End-Users with information on the processing of their data; and
• SCRIPT has been designated as responsible for handling data subject requests and complaints

Further information may be obtained upon request by contacting us at info@script.mt.

8. INTERNATIONAL TRANSFERS

 We do not generally transfer your personal data to entities outside the EEA”except as may be necessary to: (i) enable your use of the App or  to provide the Services, (ii) fulfill our contractual obligations to you or exercise our contractual obligations against you, (iii) comply with our legal or regulatory obligations or (iv) assert, file or exercise a legal claim. Where we do need to transfer your personal data outside the EEA (whether for these stated purposes or any other purpose listed in Section 6 above), we will ensure a similar degree of protection is afforded to that personal data by ensuring at least one of the following safeguards applies or is otherwise implemented:

• We will only transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data by the European Commission.
• In the absence of an adequacy decision, we will use standard contractual clauses that have been approved by the European Commission.

Please contact us at info@script.mt if you want further information on the specific mechanism used by us when transferring your personal data out of the EEA.

9. DATA SECURITY

The Internet is not a secure medium. Please also be aware that communications over the Internet, such as emails/webmails, are not secure unless they have been encrypted. Your communications may route through a number of countries before being delivered. This is the nature of the World Wide Web/Internet. We cannot accept responsibility for any unauthorised access or loss of personal information that is beyond our control. 

However, we have put in place a range of security procedures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. We also regularly review and, where practicable, improve upon these security measures. We limit access to your personal data to personnel who ‘need-to-know’ such information, as based on their respective work duties with us.

Additionally, we have also put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

10. RETENTION

Unless a different timeframe has been specifically stated in this Policy, personal data will be retained for as long as is necessary for the purpose(s) for which we originally collected it or to resolve disputes, establish legal defense, conduct audits, pursue legitimate business purposes, and enforce our contractual terms.

We may also retain information as required by applicable law.

Outside of exceptional cases, we normally apply the following retention periods:

•  10 years for payment and transaction information (for accounting and tax records); and
• 5 years following termination or other closure of your account for all other data.

There may also be other instance where we may need to retain your personal data for longer period(s), such as in relation to threatened or commenced claims, disputes, or litigation, ongoing or pending investigations, requests made by competent authorities or for audits or investigations carried out by them.

You will always retain access to your patient records and have the right for them ported to you.

Kindly contact us for further details about the retention periods that we apply.

11. YOUR LEGAL RIGHTS

Under certain circumstances, you have rights under data protection laws in relation to your personal data.

• Request access to your personal data.
• Request correction (rectification) of your personal data
• Request erasure of your personal data.
• Object to processing of your personal data.
• Request restriction of processing your personal data.
• Request transfer of your personal data.
• Right to withdraw consent.

If you wish to exercise any of the rights set out above, please contact us at info@script.mt.

No fee usually required

You will not normally have to pay a fee to exercise your data subject rights.

However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive.

Alternatively, we may refuse to comply with your request in the above circumstances.

What we may need from you

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other data subject rights).  This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up or facilitate our response.

Time limit to respond

We try to respond to all legitimate requests within the period of one month from receipt of the request.

Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

These rights are explained below.

• Access: You have the right to obtain confirmation that your information is being processed and to obtain access to your information, g., by receiving a copy of it.
• Rectification: You have the right to have your information corrected if it is inaccurate or incomplete
• Erasure: You have the right to request the deletion or removal of your information in certain circumstances.  Please note that there may be circumstances where it is not possible to fulfil the request for your information to be deleted, gif there is a legal reason to retain it.
• Object: You have the right to object to processing of your personal data where we are relying on a legitimate interest or those of a third party, and you want to object as you feel it impacts on your fundamental rights or freedoms.  You also have the right to object where we are processing your data for marketing purposes.
• Restrict: You have the right to request that the processing of your information is restricted in certain circumstances.  Again, there may be cases where we are legally entitled to refuse such a request.
• Data Portability: You have the right to request the transfer of your personal data to you or to a third party. We will provide that personal data in a structured, commonly used, machine-readable format. This right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you. Your patient records are covered by this right.
• Withdrawal: You may withdraw your consent at any time where we are relying on consent to process your personal data. This will not affect the lawfulness of any processing carried out before you withdrew your consent and any processing activities that are not based on your consent will remain unaffected. Once we have been made aware that you have withdrawn your consent, we will no longer process your data for the purpose or purposes you originally agreed to, unless we have another legitimate basis for doing so in law. In the case of health data, it would no longer be possible for us to provide the requested Services to you.

Kindly note that none of these data subject rights are absolute and must generally be weighed against our own legal obligations and legitimate interests. If a decision is taken to override your data subject request, you will be informed of this by our data protection team along with the reasons for our decision.

12. CONCLUSION

This Notice may be updated from time to time.

Please note that if our business, or any part of it, is sold or transferred at any time, the information we hold may form part of the assets transferred, although it will still only be used in accordance with this Notice.

You have the right to lodge a complaint at any time to a competent supervisory authority on data protection matters, such as in particular the supervisory authority in the place of your habitual residence or your place of work. In the case of Malta, this is the Office of the Information and Data Protection Commissioner (https://idpc.org.mt). We would, however, appreciate the opportunity to deal with your concerns before you approach the supervisory authority, so please contact us in the first instance. Please use the words ‘Data Protection Matter’ in the subject line.

We reserve the right, at our discretion, to change, modify, add, or remove portions from this Notice at any time.  Please read this Notice carefully and re-visit this page from time to time to review for changes.