This Data Protection Notice summarizes M.E.I. Safe’s commitments where Regulation (EU) 2016/679, the General Data Protection Regulation (“GDPR”), applies. It supplements the M.E.I. Safe Privacy Policy.
1. Data Controller
The data controller responsible under GDPR is:
2. Data-Protection Principles
M.E.I. Safe aims to process personal data in accordance with GDPR principles including:
- •lawfulness, fairness and transparency;
- •purpose limitation;
- •data minimization;
- •accuracy;
- •storage limitation;
- •integrity and confidentiality; and
- •accountability.
3. Health Data
M.E.I. Safe may process health-related information supplied by users for emergency-identification and information-access purposes.
Health data constitutes a special category of personal data under GDPR.
Processing such information requires an appropriate legal basis under Article 6 GDPR together with an applicable condition under Article 9 GDPR.
Where explicit consent is relied upon, M.E.I. Safe will request appropriate explicit consent and provide mechanisms for withdrawal.
4. Data Minimization
M.E.I. Safe’s emergency view is intended to prioritize information selected as relevant for emergency access rather than functioning as a complete hospital medical record.
Users should provide only information reasonably relevant to the purpose for which they use the Service.
5. Privacy by Design and Default
M.E.I. Safe intends to incorporate appropriate privacy protections into its products and processes, including:
- •access controls;
- •role separation;
- •consent controls;
- •secure defaults;
- •data minimization;
- •encryption;
- •logging;
- •deletion procedures; and
- •security testing.
6. Data Protection Impact Assessment
Because M.E.I. Safe may process sensitive health information and provide emergency profile access, M.E.I. Safe will assess whether a Data Protection Impact Assessment (DPIA) is required for relevant processing activities and deployments.
7. Processors
Where another organization processes personal data on behalf of M.E.I. Safe, appropriate contractual, technical and organizational safeguards will be implemented, including GDPR-compliant processor terms where required.
8. International Transfers
Transfers of GDPR-protected personal data outside the European Economic Area will occur only where an appropriate lawful transfer mechanism applies.
Where appropriate, supplementary technical and organizational safeguards will also be implemented.
9. Personal Data Breaches
M.E.I. Safe will maintain procedures designed to detect, investigate and respond to personal-data breaches.
Where GDPR requires notification to a supervisory authority or affected individuals, M.E.I. Safe will make the required notification within the applicable legal timeframe.
10. Data Subject Rights
Subject to GDPR conditions and exceptions, individuals may request:
- •information about processing;
- •access;
- •rectification;
- •erasure;
- •restriction;
- •portability;
- •objection; and
- •safeguards relating to certain automated decisions.
Requests may be sent to support@meisafe.com. M.E.I. Safe will respond in accordance with applicable GDPR requirements.
11. Consent Withdrawal
Where processing is based on consent, consent may be withdrawn at any time.
Withdrawal does not affect the lawfulness of processing performed before withdrawal.
12. Supervisory Authority
Individuals have the right to lodge a complaint with a competent data-protection supervisory authority.
In France, this may include the Commission Nationale de l’Informatique et des Libertés (CNIL).
13. Governance
M.E.I. Safe will maintain appropriate compliance documentation, which may include:
- •records of processing activities;
- •privacy notices;
- •consent records;
- •processor agreements;
- •international-transfer documentation;
- •DPIAs where required;
- •retention schedules;
- •security policies;
- •incident-response procedures; and
- •data-subject request procedures.