Privacy Policy

This privacy policy provides information on how personal data is handled in the Brain Twin app. The app is provided by Nordic Brain TechAS ("Nordic Brain Tech", "we").

Nordic Brain Tech is the data controller, which means that we determine the purpose of the processing of personal data that occurs in connection with the use of the App and how the processing will take place.

If you have any questions about how we process your personal data, please contact us as detailed in section 8 below.

1 Purpose and legal basis for the processing of personal data to provide Brain Twin

In order to provide Brain Twin and its digital logging service, Nordic Brain Tech processes the following personal data;

  • The user's e-mail address,
  • The user's IP address,
  • The user's operating system,
  • The user's phone's make and model, and
  • The phone's ID.

Nordic Brain Tech's legal basis for the processing of the above personal data is "performance of a contract"pursuant to GDPR art. 6 (1) b).

To ensure that the user gets the right functionality in the app, Nordic Brain Tech processes the following personal data:

  • The user's gender, and
  • The user's age.

Nordic Brain Tech processes this personal data on the basis of your consent, in accordance with GDPR art. 6 (1) a).

Furthermore, Nordic Brain Tech processes the following special categories of personal data to provide the functionality of Brain Twin and its digital logging service:

  • Information about a headache and itsintensity, frequency, duration, pain location onthe head, relatedsymptoms and triggers. The usercanalsoidentifymigraine, aura and menstruation (all entriesareoptional).
  • Information about medication intake, including the type, frequency and dosage (all entries are optional).
  • Information abouta diagnose, sick leave, life quality measures, and answers to questionaries, such as HIT-6, or satisfaction with medications (all entries are optional).
  • Personal notes can be writtenin plaintext (optional).

Nordic Brain Tech processes this personal data on the basis of your explicit consent, in accordance with GDPR art. 6 (1) b), cf. art. 9 (2) a).

2 Further processing of anonymized personal data for statistical and research purposes 

Nordic Brain Tech will anonymize personal data collected in the service to produce statistics. The anonymization process to create statistics is a further processing of personal data in line with GDPR art. 5 (1) b) and art. 89 (1).

The statistical data will be entirely anonymous. This means that it will not be possible to identify individuals from the statistics. Nordic Brain Tech ensures this by the use of several anonymization techniques. The anonymization process is fully automated, which means that we never have direct access to health information that is directly linked to an individual while the statistics are being produced.

Nordic Brain Tech uses the anonymized statistics as a basis for producing reports that may be shared with the pharmaceutical industry and other relevant actors. Nordic Brain Techwillalso use the statistics to ensure the quality of and further develop its own service.

3 Purpose and legal basis for processing personal data in relation to the distribution of newsletters

For the purpose of sending you newsletters, Nordic Brain Tech processes the following personal data:

  • The user's e-mail address.

Nordic Brain Tech processes this personal data on the basis of your consent, in accordance with GDPR art. 6 (1) a).

4 Security

Nordic Brain Tech has implemented documented technical and organizational measures to ensure that personal data is processed in a manner that ensures its confidentiality, availability and integrity.

5 Recipients of the personal data and use of subcontractors

Nordic Brain Tech uses subcontractors (data processors) for certain operational and administrative tasks. In cases where we share personal data with data processors, the processing is secured and regulated by data processing agreements. The data processing agreements ensure that the personal data is not used for other purposes and that the processing meets the requirements of the GDPR.

Nordic Brain Tech stores all information in a safe and secure manner within the EEA. In case personal data is transferred to areas outside the EEA, the transfer will be covered by an adequacy decision or standard contractual clauses (SCCs) by the EU Commission.

6 The rights of the data subject

By contacting info@nordicbraintech.noyou may request

  • access to,
  • rectificationof,
  • erasureof,
  • restrictionofprocessingof,
  • objection to and/or
  • dataportabilityof,

personal data concerning you as a data subject.

If the legal basis for the processing of your personal data is consent, you have the right to withdraw your consent at any time by contacting info@nordicbraintech.no.

You have the right to complain to your data protectionsupervisory authority about Nordic Brain Tech's processing of your personal data. The contact details of all supervisory authoritiesin the EU/EEA can be found at https://edpb.europa.eu/about-edpb/about-edpb/members_en. 

7 Retention period

We will store personal data for as long as necessary for the purpose of the processing. This means that when the user account is terminated or the purpose of the processing ceases, the personal data will be deleted, unless there is another legal basis for continued processing.

We will also delete personal data if you withdraw your consent. You can also request erasure, see section 6.

8 Contact information for the data controller

If you have any questions about how Nordic Brain Tech processes personal data, please be sure to contact: privacy@nordicbraintech.no.