Quan App Privacy Policy

Asking for consent

• We ask people to positively opt-in – individuals are invited to choose to opt in for taking a well-being assessment.
• We do not use pre-ticked boxes or any other type of consent by default.
• We use clear, plain easy to understand language at each process.
• We explain why we want the data and what we’re going to do with it.
• We name our organisation and third parties who can access the data.
• We inform individuals they can withdraw their consent.
• We inform the individual they can refuse to consent to options such as the tailored well-being journey.
• We don’t make consent a precondition of our service.
• We are clear that we do not provide services to children.

Recording consent

• We keep a record of when individuals refuse consent or wish to delete records.
• We keep a record of exactly what they were told at the time.

Managing consent

• We regularly review consent to make sure that the relationship, the processing and the purposes have not changed since consent was given.
• We have the means to refresh consent at appropriate intervals.
• We make it easy for individuals to withdraw their consent at any time, and show them how to do so.
• When consent is withdrawn, we act as soon as we can.
• We don’t penalise individuals who want to withdraw their consent.

2.0.3 – INFORMATION PROVISIONS

When collecting personal data we make sure individuals are aware of the following:

• The identity and contact details of our organisation.
• Contact details of the data protection responsible person are clear on the Quan wellbeing website.
• The consent or legitimate interests necessary for data processing and why.
• Other countries outside the EU the data may be processed.
• Tell individuals about their right to have their personal data deleted and to object to data processing in the future.
• The right to complain to the national data protection authority.

2.0.4 – THIRD PARTY DATA

• We do not supply data to any third parties for business or marketing reasons.

Third Party Services

• We may use a variety of services offered by third parties to help maintain and improve our Website, to help us understand the use of our Website and Services, or simply to provide the Services.
• These services may store both personally identifiable information about you which we collect and the information sent by your browser as part of a web page request, such as cookies or your IP address.
• If any third parties are given access to your personally identifiable information, we will limit the use of such personally identifiable information only to provide the services to us which we have requested.

2.0.5 – PROFILING

Pro­filing means evaluating personal data so you can review individual or group data.

• We provide data reports to organisations using anonymous data and inform people that any group reports will not only be completed on 6+ participants and will respect medical and client confidentiality.
• Marketing communications for all services include detail on use of data.
• We tell people how and why we profi­le personal data but give people the chance to opt-out.

2.0.6 – LEGACY DATA

• We will not continue contacting individuals after the event (Wellbeing initiative, assessment) has finished.
• All data is deleted following an event completion if required by an organisation or individual.
• If an individual wishes to delete their records; they can inform us on hello@quanwellbeing.com and we will do so expediently.

2.0. 7 – DATA STORAGE AND SECURITY

We use third party vendors and hosting partners to provide the necessary hardware, software, networking, storage, and related technology required to run Quan. We do not transfer ownership of any code, databases, Website rights or data to any third party vendors or hosting partners.

Quan Well-Being GDPR compliance - G Suite - https://gsuite.google.com/security/

Keeping users’ information safe, secure and private is the highest priority at Google. They have worked closely with data protection authorities around the world and have implemented strong privacy protections that reflect their guidance.

• Robust Safeguards: We are well placed to meet the security requirements of the applicable data protection laws.
• We constantly monitor our applications and deploy patches through automated network analysis and proprietary technology. This lets us detect and respond to threats to protect products from spam, malware, viruses, and other forms of malicious code.
• Incident Response: We will promptly inform you of incidents involving your customer data in line with the data incident terms in our agreements with you. Advanced threat detection, and avoidance technologies, 24/7 incident management
• We use security monitoring to protect users from malware
• We scan for software vulnerabilities.
• Our security and privacy experts work with development teams, reviewing code and ensuring products utilize strong security protections.
• User Transparency: We provide transparency about how data is used in our ads products. We ask users for permission to use data to personalize ads and provides transparency into how the data is used in real time.
• Privacy Practices: "We already have processes to build privacy into our products from the very earliest stages, and we are continually evolving our practices, including Data Protection Impact Assessments, to meet worldwide changing requirements including those in the GDPR around Privacy by Design and Privacy by Default."