Privacy Policy

PRIVACY POLICY – UMP RESEARCH APPLICATION
(INTEGRATION WITH HUAWEI HEALTH SERVICE KIT)

1. Purpose of the document

This Privacy Policy describes how UMP processes the data of research project participants („Participants”) in connection with integration with HUAWEI Health Service Kit. The document clearly defines the roles of the parties (UMP, Gammasoft, Huawei), the scope and purposes of processing, the place of data processing, and the rights of Participants.

2. Administrator and contact details The administrator of personal data is:

Karol Marcinkowski Medical University in Poznań,

ul. Fredry 10, 61-701 Poznań, REGON: 000288811, NIP: PL 7770003104, www.ump.edu.pl.

General contact: info@ump.edu.pl, tel. 61 8546000

Data Protection Officer (DPO): iod@ump.edu.pl

3. Roles and responsibilities of entities

• UMP – data controller: determines the purposes and methods of processing within the research project; is responsible for compliance with the GDPR.
• Gammasoft Sp. z o. o. – processor: acts solely on behalf of and on behalf of UMP, providing technical integration support (backend, researcher panel). It does not use the data for its own purposes.
• Huawei – a separate controller: collects and processes Participant data in the HUAWEI Health app and HUAWEI Cloud in accordance with its own privacy policy and regulations. UMP obtains secondary, limited access to data via the API interface, only after the Participant has given consent and to the extent necessary for the project purposes.

4. Scope of data processing and the principle of minimization

We process only the data necessary to implement the VIP 2030 project in accordance with the research protocol and project documentation. This includes:

a) Read distance, altitude, and ascent in Health Service Kit.

b) Read Health Service Kit blood oxygen data.

c) Read HUAWEI Health Kit body composition data (including body fat percentage, BMI, muscle mass, water percentage, visceral fat, bone mineral, protein ratio, skeletal muscle mass, and more).

d) Read daily activity data (such as Move, Exercise, Stand, and step count data) in Health Service Kit.

e) Read Health Service Kit caloric data (including metabolism).

f) Read Health Service Kit height and weight data.

g) Read Health Service Kit sleep data.

h) Read Health Service Kit heart rate data.

i) Read Stand data in Health Service Kit.

j) Read Health Service Kit step count data.

k) Read Health Service Kit medium to high intensity activity data.

l) Device Information: Device model/type used only for compatibility and technical problem diagnosis (not for personal identification).

When processing data, we adhere to the principle of data minimization: if a given category is not required by the study protocol or the participant’s consent, it is not collected or processed. The scope may be narrowed to the types of data actually needed.

5. Data sources and method of acquisition

• Data is synchronized from the Participant’s HUAWEI Health app to the Huawei cloud and then downloaded by the UMP system via HUAWEI Health Service Kit (REST, read only).
• The participant voluntarily consents and connects his/her Huawei account to the UMP system via OAuth 2.0 (authorization may be revoked at any time).
• We use a combined model: incremental downloads after events (notifications) and a daily replica („catch-up”) to ensure completeness.

6. Purposes and nature of processing (research, non-commercial, non-diagnostic)

• Presentation of basic indicators and trends to the Participant (informative): activity, sleep, heart rate, nocturnal SpO₂, body composition.
• Research analyses: aggregated and anonymised statistics, trend and seasonality analysis, cohort comparisons, adherence indicators (e.g. regularity of wearing the wristband, frequency of weighing).
• Data quality assurance and technical support: detecting gaps/artifacts, resolving synchronization issues, verifying device compatibility.

The data is not used for marketing or commercial profiling purposes; the application is not a medical device and is not intended for making therapeutic decisions.

7. Legal basis for processing (GDPR)

• Article 6(1)(a) of the GDPR – consent of the data subject (integration of Huawei account, reading of health data).
• Article 9(2)(a) GDPR – explicit consent to the processing of special categories of data (health data).
• Additionally, in some analytical operations of a research nature, it is possible to rely on Article 6(1)(e) of the GDPR in conjunction with Article 9(2)(j) of the GDPR (public interest in the area of scientific research), provided that this results from national law and project documentation. In practice, the prevailing basis is the Participant’s consent.

8. Data recipients and categories of data processors

On the Huawei side (a separate controller), Participant data is primarily collected and processed in HUAWEI Health and HUAWEI Cloud in accordance with their policies and the location of data centers specified by Huawei, within the EU/EEA. Details can be found in Huawei’s privacy policy:

https://legal.cloud.huawei.com/legal/health/privacy-statement.htm?&code=PL&language=pl-PL On the UMP/Gammasoft side, data is processed by authorized UMP employees and associates, and by Gammasoft as a processor. We do not share data with third parties beyond what is necessary for research and legal obligations. We do not sell data. Technology providers (e.g., data center operators) act as processors under agreements that provide the required safeguards.

9. Transfer of data outside the EEA

We do not transfer data outside the European Economic Area. Processing takes place on UMP’s infrastructure in the EU (on-premises/data center under UMP’s control). Communication with the Huawei service is carried out using secure protocols; we do not initiate additional transfers outside the EEA.

10. Storage period

Data is retained no longer than December 31, 2030, unless the project documentation specifies shorter periods for specific categories. After project completion, we retain data for 5 years for archival/evidence purposes required by the grantor and regulations, after which the data is anonymized or deleted in accordance with the UMP retention policy.

11. Security

We use TLS and at-rest data encryption, role-based access control, access and operation logging (auditing), environment segregation, and the principle of least privilege. Participant identifiers in the system are pseudonymous (e.g., open_id). OAuth accesses and keys are protected in a secure repository.

12. Participants – age requirements

The project involves adults. Data from minors is not processed.

13. Participant’s Rights

Participants have the right to: access, rectify, erase („right to be forgotten”), restrict processing, transfer data (to the extent technically possible), withdraw consent at any time (without affecting the lawfulness of processing prior to withdrawal), and object to processing – provided the legal basis for processing allows for this. Participants also have the right to lodge a complaint with the President of the Personal Data Protection Office.

14. Withdrawal of consent / disconnection of Huawei account

You can disconnect your Huawei account at any time in the app (Linked Accounts section) or by contacting UMP/IODe. After disconnection, we will no longer access your data, and your data will be deleted or anonymized in accordance with Section 10.

15. Cookies and logs

The mobile app does not use cookies. The researcher’s panel (web application) may use technical cookies necessary for session authentication. System logs do not contain measurement data or data that directly identifies the participant.

16. Policy Changes

We may update this Policy due to changes in regulations or functionality. The new version will be published at the permanent address https://vip2030.ump.edu.pl/. In the event of significant changes, we will notify Participants through the appropriate channel.

17. Contact

For privacy and data protection matters, please contact: info@ump.edu.pl

IOD: iod@ump.edu.pl.

---

Privacy policy for the website https://vip2030.ump.edu.pl/

1. Data controller

The controller of personal data processed in connection with the use of the website is:

Karol Marcinkowski Medical University in Poznań,

ul. Fredry 10, 61-701 Poznań,

phone no. +48 61 854 60 00,

e-mail:ump@ump.edu.pl

In matters related to the protection of personal data, you can contact the Data Protection Supervisor at:iod@ump.edu.pl.

2. Scope of data processed

The following data may be collected when using the website:

• device IP address,
• information about your browser and operating system,
• data provided voluntarily by users in contact forms (e.g. name, surname, e-mail address, telephone number).

3. Purposes of processing

Personal data are processed for the purpose of:

• enabling the use of website functionality,
• handling inquiries submitted via forms,
• ensuring the security and proper operation of the website,
• maintaining visit statistics.

4. Legal basis

Data is processed on the basis of:

• Article 6(1)(a) of the GDPR – user consent,
• Article 6(1)(e) of the GDPR – performance of tasks in the public interest,
• Article 6(1)(f) of the GDPR – legitimate interest of the controller (ensuring the security of the website).

5. Data recipients

Data may be made available to entities providing services to the University (e.g. IT services, hosting), only to the extent necessary to provide these services.

6. Data storage period

The data will be stored for the period necessary to achieve the indicated purposes or until the user withdraws consent.

7. Rights of data subjects

The user has the right to:

• access to your data,
• rectification, deletion or restriction of processing,
• data transfer,
• object to processing,
• withdraw consent at any time,
• lodging a complaint with the President of the Personal Data Protection Office.

8. Cookies

This website uses cookies to ensure proper operation and to gather visitor statistics.

Users can manage cookie settings in their browser.

9. Data security

The Administrator uses technical and organizational measures to ensure the protection of processed personal data, appropriate to the threats and categories of data being protected.

10. Changes to the privacy policy

The privacy policy may be updated from time to time. The current version will always be posted on the website.vip2030.ump.edu.pl.